search

itm4n / VBA-RunPE

A VBA implementation of the RunPE technique or how to bypass application whitelisting.
MIT License
789 stars 180 forks source link

Feature request - auto imports #1

Closed Lexus89 closed 4 years ago

Lexus89 commented 6 years ago

First of all thanks for making this great tool! Would it be possible to detect the neccessary imports and do that automatically? That would make it much easier to run other tools as well.

itm4n commented 6 years ago

Hello, Thanks for your message.

First, my understandiing of RunPE is still very limited so I'm not even sure that's what is causing the issue. Then, my initial goal was to access PowerShell in heavily constrained Citrix environements, which I was able to do thanks to this code.

That being said, I'm interested to know what kind of tools you are trying to run this way. Using PowerShell, you can run a lot of things already.

I'll leave this issue open as a reminder to improve my code anyway... ;)

itm4n commented 4 years ago

Process Hollowing doesn't require to manually resolve imports from the import table.