search

Pepitoh / VBad

VBA Obfuscation Tools combined with an MS office document generator
MIT License
531 stars 129 forks source link

Issue with running Macro #11

Closed telltell3 closed 7 years ago

telltell3 commented 7 years ago

Hello Pepitoh,

I would like to start off by saying, thank you for the awesome tool. I hope to be able to contribute to the project as I learn to improve my coding practice.

I am having an issue that I would like some guidance on. VBad...is doing exactly what it should. Everything is going find on that part. The trouble I am having is when I run the Macro. I am getting a compile error. I have gone back through the original code to do some "cleaning", but I am still getting the same compile error: expected end of statement. I thought maybe since it could have been a "" " " "" kind of an error. I looked to see if that was the case and corrected it, but I keep getting the same errors.

I have not changed a whole lot from your original code. I am looking more of a proof of concept that I can get it to work for myself. I have included all the files in the attachment.

4Pepitoh_No_VBad.doc- this document is the original Macro. When I run the Macro I get a meterpreter session no problem.

4Pepitoh.txt- this is the Macro I am using in a txt pad

original_vba_prepared_1.vbs - this is the script I was using with VBad. In this one, I did not use any mark downs on any of the strings.

original_vba_prepared_2.vbs - same as script above however, I marked down the strings on this one.

No_random_fucntions_Survey_2016.doc - This doc file has been embed with the output from VBad. I get an error on this document. This one does not have the strings marked down.

Randomization_Survey_2016.doc- This doc file has been embed with the output from VBad. I get an error on this document as well. On this one the strings have been marked down

Again any help, advice or tips you can give will be greatly appreciated.

Thank you for the tool.

telltell

original_vba_prepared_2.vbs.txt No_random_fucntions_Survey_2016.docx Radomization_Survey_2016.docx 4Pepitoh_No_VBad.docx 4Pepitoh.txt original_vba_prepared_1.vbs.txt

Pepitoh commented 7 years ago

Hi telltell3,

Thanks for opening this issue, I managed to reproduce your problem and you are right, it a bit tricky to solve :-), the regex selecting all string is messing up with string contening quotes (Why on earth VBA implements such a way of insering quotes in strings..)

I'm working on it, should not be too long to fix, I keep you in touch as soon as I can.

Pepitoh.

Pepitoh commented 7 years ago

Hi telltell3,

Problem is now solved in new commit :+1:, string with two consecutive double quotes are now handled by the regex in const.py.

Thx for the report.

Pepitoh.