pcodedmp
macro_pack
| pcodedmp | macro_pack | |
|---|---|---|
| 2 | 4 | |
| 437 | 1,997 | |
| - | - | |
| 0.0 | 0.0 | |
| almost 3 years ago | almost 2 years ago | |
| Python | Python | |
| GNU General Public License v3.0 only | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
pcodedmp
-
Anyone know where VBA would stand efficiency-wise on this list? I can't seem to find any VBA efficiency studies.
The read-me of this github repo has a good overview of the process, from which the below is taken:
-
How to programmatically verify that VBA signature is valid
vbaProject.bin - Holds compressed versions of the human text VBA code, and the compiled "P-code". See: https://github.com/bontchev/pcodedmp
macro_pack
- Docx, doc macro rev shell generator?
- hey guys which would be easier to make, a malicious docx or pdf?
- MacroPack - will simplify antimalware solutions bypass and automatize the process from vb source to final Office document or other maldoc payload type. This tool can be used for red teaming, pentests, demos, and social engineering assessments.
-
Trying to bypass Antivirus with a malicious Word document (VBA macro attack) stomped with EvilClippy
If you are new to macros and obfuscation in general I recommend you to not use meterpreter as your C2 because there are too many signatures for it. You need an AMSI bypass here + shellcode changes / in memory scanner evasion. Try some of the „newer“ C2 open source tools. If you are using a powershell stager you will most likely only need an AMSI bypass. Build the macro itself manually. You can obfuscate it afterwards using https://github.com/sevagas/macro_pack for example to change the signature. This should work for most AV vendors.
What are some alternatives?
plasma - Plasma is an interactive disassembler for x86/ARM/MIPS. It can generates indented pseudo-code with colored syntax.
Amsi-Bypass-Powershell - This repo contains some Amsi Bypass methods i found on different Blog Posts.
oletools - oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
boobsnail - BoobSnail allows generating Excel 4.0 XLM macro. Its purpose is to support the RedTeam and BlueTeam in XLM macro generation.
pwndbg - Exploit Development and Reverse Engineering with GDB Made Easy
ViperMonkey - A VBA parser and emulation engine to analyze malicious macros.
git-xl - Git extension: Makes git-diff work for VBA in Excel workbooks (xls* file types)
VBA-Macro-Reverse-Shell - Fully functioning reverse shell written entirely in VBA.
Python-Rootkit - Python Remote Administration Tool (RAT) to gain meterpreter session
tibia_terminator - Auto-heal, auto-mana, auto-haste, auto-utamo, auto-amulet, auto-ring and auto-tank for Tibia Linux client.
PowerShell-Obfuscation-Bible - A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion, compiled for educational purposes. The contents of this repository are the result of personal research, including reading materials online and conducting trial-and-error attempts in labs and pentests.