khr0x40sh / MacroShop

Collection of scripts to aid in delivering payloads via Office Macros. Most are python. See http://khr0x40sh.wordpress.com for details.
MIT License
404 stars 116 forks source link

I can not save the document #13

Open mxmx7 opened 7 years ago

mxmx7 commented 7 years ago

hello, please help. I did everything so as you wrote.after generating the code macro, and inserting it in a word I can not get it save the document. I tried everything, I do not know what the error. I changed to the Private Sub Document_Open, I have installed pefile, I use VM win7pro 32bit and Microsoft Office 2016.

needs your program

please help

khr0x40sh commented 7 years ago

Can you paste the Macro code here or on pastebin and provide the link? Thanks.

mxmx7 commented 7 years ago

Thanks for the answer command: python exeinvba.py --exe putty.exe --out putty.vb

http://wklejaj.pl/GYQ9EdyPPAXX


command: python exeinvba.py --exe putty.exe --out putty.vb --dest C:\Users\admin\Downloads\MacroMaster\putty.exe (putty is located in folder MacroMaster)

http://wklejaj.pl/1XWmDyS9cwXX
pastebin only has a 512 kb limit

khr0x40sh commented 7 years ago

[EDIT]: Another solution to your specific problem, but there is a cap on how large the file can be. Putty should be ok as I have used this to transfer putty before.

Your --dest variable should have the backslashes doubled up. Try that and see if it works (e.g C:\\Users\\Public\\Downloads\\test.exe)

There is a limit on how large a macro can be. Two parts of the problem:

1) The length of a variable is limited to 64K (http://stackoverflow.com/questions/10927764/vba-string-limit) 2) The length of continuous lines before the sub main appears to be limited to 1400 or so lines http://excelribbon.tips.net/T010449_Maximum_Length_Limit_for_a_Macro.html

I will add this to bugfix and see if I can come up with a solution for larger binaries, but things under 1 MB should easily be under the cap.

khr0x40sh commented 7 years ago

Also, the code won't create the directory on the machine the macro is run on. So the destination path will need to exist prior to executing the macro (not sure if that's the case with the second paste or not, but something to keep in mind).

If after attempting these workarounds, you are still having issues, please let me know.

sevagas commented 7 years ago

Hi, I added the exeinVBA feature in https://github.com/sevagas/macro_pack (EMBED_EXE template) I am also struggling with > 1mega exe pbs. I will tell you when I find the solutions. Regards, Emeric

khr0x40sh commented 7 years ago

I've been testing with adding the content in chunks to the cells of the excel and then having the Macro read those in and piece the file together that way. Haven't figured out all the bugs yet, but it looks promising. Might be worth a shot for you to try as well as I am swamped with other things and may be some time before I finish.

Thanks for the head's up.

sevagas commented 7 years ago

I am looking into another solution, generate multiple VBA modules to avoid the 64k compiled code module size limit. But I face another problem. It seems some base 64 representation is not accepted by VBA, even on very small file. I have no clue why

praveenyadav1602 commented 7 years ago

It seems some base 64 representation is not accepted by VBA, even on very small file. I have no clue why?

not a programmer like you, but i am also searching solution for this from last few days

khr0x40sh commented 7 years ago

Interesting...

On Mon, Oct 30, 2017 at 11:34 AM, praveenyadav1602 <notifications@github.com

wrote:

It seems some base 64 representation is not accepted by VBA, even on very small file. I have no clue why?

not a programmer like you, but i am also searching solution for this from last few days

— You are receiving this because you were assigned. Reply to this email directly, view it on GitHub https://github.com/khr0x40sh/MacroShop/issues/13#issuecomment-340482634, or mute the thread https://github.com/notifications/unsubscribe-auth/AGWSu31WcWL6DiPKHQVeU74J9nB0S96Qks5sxeyRgaJpZM4LiWhn .