Skip to content

Commit 5ac70f6

Browse files
med0x2emed0x2e
committed
Added Support to generate VBA scripts (hex or b64 encoded gadgets)
1 parent db2a124 commit 5ac70f6

File tree

9 files changed

+343
-112
lines changed

9 files changed

+343
-112
lines changed

‎.DS_Store‎

6 KB
Binary file not shown.

‎GadgetToJScript/.DS_Store‎

6 KB
Binary file not shown.

‎GadgetToJScript/GadgetToJScript.csproj‎

Lines changed: 92 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,90 +1,92 @@
1-
<?xml version="1.0" encoding="utf-8"?>
2-
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3-
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
4-
<PropertyGroup>
5-
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
6-
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
7-
<ProjectGuid>{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}</ProjectGuid>
8-
<OutputType>Exe</OutputType>
9-
<RootNamespace>GadgetToJScript</RootNamespace>
10-
<AssemblyName>GadgetToJScript</AssemblyName>
11-
<TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>
12-
<FileAlignment>512</FileAlignment>
13-
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
14-
<Deterministic>true</Deterministic>
15-
</PropertyGroup>
16-
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
17-
<PlatformTarget>AnyCPU</PlatformTarget>
18-
<DebugSymbols>true</DebugSymbols>
19-
<DebugType>full</DebugType>
20-
<Optimize>false</Optimize>
21-
<OutputPath>bin\Debug\</OutputPath>
22-
<DefineConstants>DEBUG;TRACE</DefineConstants>
23-
<ErrorReport>prompt</ErrorReport>
24-
<WarningLevel>4</WarningLevel>
25-
</PropertyGroup>
26-
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
27-
<PlatformTarget>AnyCPU</PlatformTarget>
28-
<DebugType>pdbonly</DebugType>
29-
<Optimize>true</Optimize>
30-
<OutputPath>bin\Release\</OutputPath>
31-
<DefineConstants>TRACE</DefineConstants>
32-
<ErrorReport>prompt</ErrorReport>
33-
<WarningLevel>4</WarningLevel>
34-
</PropertyGroup>
35-
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x86'">
36-
<DebugSymbols>true</DebugSymbols>
37-
<OutputPath>bin\x86\Debug\</OutputPath>
38-
<DefineConstants>DEBUG;TRACE</DefineConstants>
39-
<DebugType>full</DebugType>
40-
<PlatformTarget>x86</PlatformTarget>
41-
<ErrorReport>prompt</ErrorReport>
42-
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
43-
<Prefer32Bit>true</Prefer32Bit>
44-
</PropertyGroup>
45-
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x86'">
46-
<OutputPath>bin\x86\Release\</OutputPath>
47-
<DefineConstants>TRACE</DefineConstants>
48-
<Optimize>true</Optimize>
49-
<DebugType>pdbonly</DebugType>
50-
<PlatformTarget>x86</PlatformTarget>
51-
<ErrorReport>prompt</ErrorReport>
52-
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
53-
<Prefer32Bit>true</Prefer32Bit>
54-
</PropertyGroup>
55-
<ItemGroup>
56-
<Reference Include="NDesk.Options, Version=0.2.1.0, Culture=neutral, processorArchitecture=MSIL">
57-
<HintPath>..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll</HintPath>
58-
</Reference>
59-
<Reference Include="System" />
60-
<Reference Include="System.Configuration" />
61-
<Reference Include="System.Core" />
62-
<Reference Include="System.Runtime.Remoting" />
63-
<Reference Include="System.Web" />
64-
<Reference Include="System.Xml.Linq" />
65-
<Reference Include="System.Data.DataSetExtensions" />
66-
<Reference Include="Microsoft.CSharp" />
67-
<Reference Include="System.Data" />
68-
<Reference Include="System.Net.Http" />
69-
<Reference Include="System.Xml" />
70-
</ItemGroup>
71-
<ItemGroup>
72-
<Compile Include="Program.cs" />
73-
<Compile Include="Properties\AssemblyInfo.cs" />
74-
<Compile Include="TestAssemblyLoader.cs" />
75-
<Compile Include="_ASurrogateGadgetGenerator.cs" />
76-
<Compile Include="_DisableTypeCheckGadgetGenerator.cs" />
77-
<Compile Include="_SurrogateSelector.cs" />
78-
</ItemGroup>
79-
<ItemGroup>
80-
<None Include="App.Config">
81-
<SubType>Designer</SubType>
82-
</None>
83-
<None Include="packages.config" />
84-
<EmbeddedResource Include="templates\htascript.template" />
85-
<EmbeddedResource Include="templates\jscript.template" />
86-
<EmbeddedResource Include="templates\jscript-regfree.template" />
87-
<EmbeddedResource Include="templates\vbscript.template" />
88-
</ItemGroup>
89-
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
90-
</Project>
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
4+
<PropertyGroup>
5+
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
6+
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
7+
<ProjectGuid>{AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9}</ProjectGuid>
8+
<OutputType>Exe</OutputType>
9+
<RootNamespace>GadgetToJScript</RootNamespace>
10+
<AssemblyName>GadgetToJScript</AssemblyName>
11+
<TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>
12+
<FileAlignment>512</FileAlignment>
13+
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
14+
<Deterministic>true</Deterministic>
15+
</PropertyGroup>
16+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
17+
<PlatformTarget>AnyCPU</PlatformTarget>
18+
<DebugSymbols>true</DebugSymbols>
19+
<DebugType>full</DebugType>
20+
<Optimize>false</Optimize>
21+
<OutputPath>bin\Debug\</OutputPath>
22+
<DefineConstants>DEBUG;TRACE</DefineConstants>
23+
<ErrorReport>prompt</ErrorReport>
24+
<WarningLevel>4</WarningLevel>
25+
</PropertyGroup>
26+
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
27+
<PlatformTarget>AnyCPU</PlatformTarget>
28+
<DebugType>pdbonly</DebugType>
29+
<Optimize>true</Optimize>
30+
<OutputPath>bin\Release\</OutputPath>
31+
<DefineConstants>TRACE</DefineConstants>
32+
<ErrorReport>prompt</ErrorReport>
33+
<WarningLevel>4</WarningLevel>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x86'">
36+
<DebugSymbols>true</DebugSymbols>
37+
<OutputPath>bin\x86\Debug\</OutputPath>
38+
<DefineConstants>DEBUG;TRACE</DefineConstants>
39+
<DebugType>full</DebugType>
40+
<PlatformTarget>x86</PlatformTarget>
41+
<ErrorReport>prompt</ErrorReport>
42+
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
43+
<Prefer32Bit>true</Prefer32Bit>
44+
</PropertyGroup>
45+
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x86'">
46+
<OutputPath>bin\x86\Release\</OutputPath>
47+
<DefineConstants>TRACE</DefineConstants>
48+
<Optimize>true</Optimize>
49+
<DebugType>pdbonly</DebugType>
50+
<PlatformTarget>x86</PlatformTarget>
51+
<ErrorReport>prompt</ErrorReport>
52+
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
53+
<Prefer32Bit>true</Prefer32Bit>
54+
</PropertyGroup>
55+
<ItemGroup>
56+
<Reference Include="NDesk.Options, Version=0.2.1.0, Culture=neutral, processorArchitecture=MSIL">
57+
<HintPath>..\packages\NDesk.Options.0.2.1\lib\NDesk.Options.dll</HintPath>
58+
</Reference>
59+
<Reference Include="System" />
60+
<Reference Include="System.Configuration" />
61+
<Reference Include="System.Core" />
62+
<Reference Include="System.Runtime.Remoting" />
63+
<Reference Include="System.Web" />
64+
<Reference Include="System.Xml.Linq" />
65+
<Reference Include="System.Data.DataSetExtensions" />
66+
<Reference Include="Microsoft.CSharp" />
67+
<Reference Include="System.Data" />
68+
<Reference Include="System.Net.Http" />
69+
<Reference Include="System.Xml" />
70+
</ItemGroup>
71+
<ItemGroup>
72+
<Compile Include="Program.cs" />
73+
<Compile Include="Properties\AssemblyInfo.cs" />
74+
<Compile Include="TestAssemblyLoader.cs" />
75+
<Compile Include="_ASurrogateGadgetGenerator.cs" />
76+
<Compile Include="_DisableTypeCheckGadgetGenerator.cs" />
77+
<Compile Include="_SurrogateSelector.cs" />
78+
</ItemGroup>
79+
<ItemGroup>
80+
<None Include="App.Config">
81+
<SubType>Designer</SubType>
82+
</None>
83+
<None Include="packages.config" />
84+
<EmbeddedResource Include="templates\htascript.template" />
85+
<EmbeddedResource Include="templates\jscript.template" />
86+
<EmbeddedResource Include="templates\jscript-regfree.template" />
87+
<EmbeddedResource Include="templates\vbscript.template" />
88+
<EmbeddedResource Include="templates\vbascripthex.template" />
89+
<EmbeddedResource Include="templates\vbascriptb64.template" />
90+
</ItemGroup>
91+
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
92+
</Project>

‎GadgetToJScript/Program.cs‎

Lines changed: 109 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// GadgetToJscript.
1+
// GadgetToJscript.
22
// Copyright (C) Elazaar / @med0x2e 2019
33
//
44
// GadgetToJscript is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by
@@ -13,10 +13,13 @@
1313

1414
using NDesk.Options;
1515
using System;
16+
using System.Collections.Generic;
1617
using System.Configuration;
1718
using System.IO;
19+
using System.Linq;
1820
using System.Reflection;
1921
using System.Runtime.Serialization.Formatters.Binary;
22+
using System.Text;
2023

2124
namespace GadgetToJScript{
2225

@@ -31,10 +34,17 @@ enum EWSH
3134
hta
3235
}
3336

37+
enum ENC
38+
{
39+
b64,
40+
hex
41+
}
42+
3443

3544
private static string _wsh;
3645
private static string _outputFName = "test";
3746
private static bool _regFree = false;
47+
private static string _enc = "b64";
3848

3949
static void Main(string[] args)
4050
{
@@ -44,6 +54,7 @@ static void Main(string[] args)
4454

4555
OptionSet options = new OptionSet(){
4656
{"w|scriptType=","js, vbs, vba or hta", v =>_wsh=v},
57+
{"e|encodeType=","VBA gadgets encoding: b64 or hex (default set to b64)", v => _enc=v},
4758
{"o|output=","Generated payload output file, example: C:\\Users\\userX\\Desktop\\output (Without extension)", v =>_outputFName=v},
4859
{"r|regfree","registration-free activation of .NET based COM components", v => _regFree = v != null},
4960
{"h|help=","Show Help", v => show_help = v != null},
@@ -64,6 +75,12 @@ static void Main(string[] args)
6475
showHelp(options);
6576
return;
6677
}
78+
79+
if (!Enum.IsDefined(typeof(ENC), _enc))
80+
{
81+
showHelp(options);
82+
return;
83+
}
6784
}
6885
catch (Exception e)
6986
{
@@ -85,10 +102,15 @@ static void Main(string[] args)
85102
resourceName = "GadgetToJScript.templates.vbscript.template";
86103
break;
87104
case "vba":
88-
Console.WriteLine("Not supported yet, only JS, VBS and HTA are supported at the moment");
89-
return;
90-
//resourceName = "GadgetToJScript.templates.vbascript.template";
91-
//break;
105+
//Console.WriteLine("Not supported yet, only JS, VBS and HTA are supported at the moment");
106+
//return;
107+
if (_enc == "b64") {
108+
resourceName = "GadgetToJScript.templates.vbascriptb64.template";
109+
}
110+
else{
111+
resourceName = "GadgetToJScript.templates.vbascripthex.template";
112+
}
113+
break;
92114
case "hta":
93115
resourceName = "GadgetToJScript.templates.htascript.template";
94116
break;
@@ -122,13 +144,62 @@ static void Main(string[] args)
122144

123145

124146
using (Stream stream = assembly.GetManifestResourceStream(resourceName))
125-
using (StreamReader reader = new StreamReader(stream))
126-
{
127-
_wshTemplate = reader.ReadToEnd();
128-
_wshTemplate = _wshTemplate.Replace("%_STAGE1_%", Convert.ToBase64String(_msStg1.ToArray()));
129-
_wshTemplate = _wshTemplate.Replace("%_STAGE1Len_%", _msStg1.Length.ToString());
130-
_wshTemplate = _wshTemplate.Replace("%_STAGE2_%", Convert.ToBase64String(_msStg2.ToArray()));
131-
_wshTemplate = _wshTemplate.Replace("%_STAGE2Len_%", _msStg2.Length.ToString());
147+
148+
if (_wsh != "vba"){
149+
150+
using (StreamReader reader = new StreamReader(stream))
151+
{
152+
_wshTemplate = reader.ReadToEnd();
153+
_wshTemplate = _wshTemplate.Replace("%_STAGE1_%", Convert.ToBase64String(_msStg1.ToArray()));
154+
_wshTemplate = _wshTemplate.Replace("%_STAGE1Len_%", _msStg1.Length.ToString());
155+
_wshTemplate = _wshTemplate.Replace("%_STAGE2_%", Convert.ToBase64String(_msStg2.ToArray()));
156+
_wshTemplate = _wshTemplate.Replace("%_STAGE2Len_%", _msStg2.Length.ToString());
157+
}
158+
}
159+
else{
160+
List<string> stage1Lines = new List<String>();
161+
List<string> stage2Lines = new List<String>();
162+
163+
if (_enc == "b64")
164+
{
165+
stage1Lines = SplitToLines(Convert.ToBase64String(_msStg1.ToArray()), 100).ToList();
166+
stage2Lines = SplitToLines(Convert.ToBase64String(_msStg2.ToArray()), 100).ToList();
167+
}
168+
else{
169+
stage1Lines = SplitToLines(BitConverter.ToString(_msStg1.ToArray()).Replace("-", ""), 100).ToList();
170+
stage2Lines = SplitToLines(BitConverter.ToString(_msStg2.ToArray()).Replace("-", ""), 100).ToList();
171+
}
172+
173+
174+
StringBuilder _b1 = new StringBuilder();
175+
_b1.Append("stage_1 = \"").Append(stage1Lines[0]).Append("\"");
176+
_b1.AppendLine();
177+
stage1Lines.RemoveAt(0);
178+
179+
foreach (String line in stage1Lines)
180+
{
181+
_b1.Append("stage_1 = stage_1 & \"").Append(line.ToString().Trim()).Append("\"");
182+
_b1.AppendLine();
183+
}
184+
185+
StringBuilder _b2 = new StringBuilder();
186+
_b2.Append("stage_2 = \"").Append(stage2Lines[0]).Append("\"");
187+
_b2.AppendLine();
188+
stage2Lines.RemoveAt(0);
189+
190+
foreach (String line in stage2Lines)
191+
{
192+
_b2.Append("stage_2 = stage_2 & \"").Append(line.ToString().Trim()).Append("\"");
193+
_b2.AppendLine();
194+
}
195+
196+
197+
using (StreamReader reader = new StreamReader(stream))
198+
{
199+
_wshTemplate = reader.ReadToEnd();
200+
_wshTemplate = _wshTemplate.Replace("%_STAGE1_%", _b1.ToString());
201+
_wshTemplate = _wshTemplate.Replace("%_STAGE2_%", _b2.ToString());
202+
}
132203
}
133204

134205
using (StreamWriter _generatedWSH = new StreamWriter(_outputFName + "." + _wsh))
@@ -154,5 +225,31 @@ public static byte[] readRawShellcode(string _SHFname)
154225
}
155226
return _buf;
156227
}
228+
229+
public static IEnumerable<string> SplitToLines(string stringToSplit, int maximumLineLength)
230+
{
231+
var words = stringToSplit.Split(' ').Concat(new[] { "" });
232+
return words.Skip(1).Aggregate(words.Take(1).ToList(),
233+
(a, w) =>
234+
{
235+
var last = a.Last();
236+
while (last.Length > maximumLineLength)
237+
{
238+
a[a.Count() - 1] = last.Substring(0, maximumLineLength);
239+
last = last.Substring(maximumLineLength);
240+
a.Add(last);
241+
}
242+
var test = last + " " + w;
243+
if (test.Length > maximumLineLength)
244+
{
245+
a.Add(w);
246+
}
247+
else
248+
{
249+
a[a.Count() - 1] = test;
250+
}
251+
return a;
252+
});
253+
}
157254
}
158255
}

‎GadgetToJScript/bin/.DS_Store‎

6 KB
Binary file not shown.

‎GadgetToJScript/bin/x86/.DS_Store‎

6 KB
Binary file not shown.

0 commit comments

Comments
 (0)