VBA RunPE

Description

A simple yet effective implementation of the RunPE technique in VBA. This code can be used to run executables from the memory of Word or Excel. It is compatible with both 32 bits and 64 bits versions of Microsoft Office 2010 and above.

More info here:
https://itm4n.github.io/vba-runpe-part1/
https://itm4n.github.io/vba-runpe-part2/

Usage 1 - PE file on disk

1) In the

Exploit

strSrcFile = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

_/!\_ If you're using a 32 bits version of Microsoft Office on a 64 bits OS, you must specify 32 bits binaries.

strSrcFile = "C:\Windows\SysWOW64\cmd.exe"
strSrcFile = "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"

2) Specify the command line arguments (optional).

strArguments = "-exec Bypass"

This will be used to form a command line equivalent to:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -exec Bypass

3) (Optional) Enable View > Immediate Window (

Ctrl+G

4) Run the

Exploit

Usage 2 - Embedded PE

1. Use

   pe2vba.py

   to convert a PE file to VBA. This way, it can be directly embedded into the macro.

[email protected]:~/Tools/VBA-RunPE$ ./pe2vba.py meterpreter.exe 
[+] Created file 'meterpreter.exe.vba'.

1. ~~Replace the following code in

   RunPE.vba

   with the the content of the

   .vba

   file which was generated in the previous step.~~ The Python script converts the PE to VBA and applies the RunPE template automatically (no need to copy/paste manually).

' ================================================================================
'                                ~~~ EMBEDDED PE ~~~
' ================================================================================

' CODE GENRATED BY PE2VBA
' ===== BEGIN PE2VBA =====
Private Function PE() As String
    Dim strPE As String
    strPE = ""
    PE = strPE
End Function
' ===== END PE2VBA =====

1. (Optional) Enable View > Immediate Window (

   Ctrl+G

   ) to check execution and error logs.

2. Run the

   Exploit

   macro!

_/!\_ When using an embedded PE, the macro will automatically switch to this mode because the

PE()

Known issues

• GetThreadContext()

  fails with error code 998.

You might get this error if you run this macro from a 64-bits version of Office. ~~As a workaround, you can move the code to a module rather than executing it from the Word Object references. Thanks @joeminicucci for the tip.~~

================================================================================
[*] Source file: 'C:\Windows\System32\cmd.exe'
[*] Checking source PE...
[*] Creating new process in suspended state...
[*] Retrieving the context of the main thread...
    |__ GetThreadContext() failed (Err: 998)

~~I have no idea why this workaround works for the moment. I've investigated this a bit though.~~ This error seems to be caused by the

CONTEXT

[VBA] LenB(CONTEXT) != [C++] sizeof(CONTEXT)

GetThreadContext()

Edit 2019-12-15: the definition of the 64-bits version of the

CONTEXT

CONTEXT

GetThreadContext()

SetThreadContext()

Byte

Edit 2019-12-17: I finally found the problem. My first assumption was correct, the

CONTEXT

align(16)

GetThreadContext()

SetThreadContext()

Byte

• LongPtr

  - _User Defined Type Not Defined_

If you get this error, it means that you are running the macro from an old version of Office (<=2007). The

LongPtr

As a workaround, you can replace all the

LongPtr

Long

LongLong

Ctrl+H

Credits

@hasherezade - Complete RunPE implementation (https://github.com/hasherezade/)

@Zer0Mem0ry - 32 bits RunPE written in C++ (https://github.com/Zer0Mem0ry/RunPE)

@DidierStevens - PE embedding in VBA

Misc

Tests

This code was tested on the following platforms: - Windows 7 Pro 32 bits + Office 2010 32 bits - Windows 7 Pro 64 bits + Office 2016 32 bits - Windows 2008 R2 64 bits + Office 2010 64 bits - Windows 10 Pro 64 bits + Office 2016 64 bits

Side notes

Here is a table of correspondence between some Win32 and VBA types:

| C++ | VBA | Arch | | --- | --- | --- | | BYTE | Byte | 32 & 64 | | WORD | Integer | 32 & 64 | | DWORD, ULONG, LONG | Long | 32 & 64 | | DWORD64 | LongLong | 64 | | HANDLE | LongPtr(*) | 32 & 64 | LPSTR | String | 32 & 64 | | LPBYTE | LongPtr(*) | 32 & 64 |

(*) LongPtr is a "dynamic" type, it is 4 Bytes long in Office 32 bits and 8 Bytes long in Office 64 bits. https://msdn.microsoft.com/fr-fr/library/office/ee691831(v=office.14).aspx