khr0x40sh / MacroShop

Collection of scripts to aid in delivering payloads via Office Macros. Most are python. See http://khr0x40sh.wordpress.com for details.
MIT License
404 stars 116 forks source link

Hide Macro Warnings #5

Open vendforce opened 8 years ago

vendforce commented 8 years ago

Is there a way to incorporate a batch script with a macro to disable the macro security warnings.

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security /v VBAWarnings /t REG_DWORD /d 1 /f

khr0x40sh commented 8 years ago

You would need to be admin on the box to do so. I can look into if doing so at runtime will actually work, but this would be an unsupported bonus feature if I get it added. I'll let you know when I update the code.

vendforce commented 8 years ago

I was thinking, if disabling macro in runtime can't be acheived , can some vb code check status of the macro security settings and if security is enabled disable the macro so no warnings are shown in otherwords do not run or attemp to run the macro as startup it would only show the text in the document , it would make it a little more stealthy

this way it wont #create any suspicion , while this will limit the machines that would be vunerable , it hides the attempts and does'nt create any suspicions , but Im sure there are plenty of machines out there that have macros enabled

khr0x40sh commented 8 years ago

AFAIK, the vb won't run until macros are enabled.

vendforce commented 8 years ago

Yea sorry it was a brainfart, after I posted it I thought to myself in order for vba or macro to run the warnings are going to pop up , thats the whole point of the security warning nothing can run in the background unless the users enables the macro/vba DOH !!!!!! . I'm hoping during run time the reg key can be changed , in the meanwhile what I've done is create a macro to hide the text and have the text look like its corrupt encoding and inform the user to enable the macros to fix the encoding after they enable the macro the rest of the text is unhidden and the document looks complete