inf0secrabbit/badassmacros

BadAssMacros - C# based automated Malicous Macro Generator.

badassmacros's Issues

Porting to x64 Office support

Hi guys,

Just wanted to post this here in case anyone was wondering how to add x64 support. Essentially, you should replace all x86 "Long" pointer types with "LongPtr" types. This vbtype will automatically select the "Long" for x86 and "LongLong" for x64. Do not just blindly replace Long, but look at the Win32 API specification and convert types appropriately. If a Win32 API parameter or result is not a pointer, it should not be converted to "LongLong" and therefore "LongPtr" should not be used.

The following example could help: https://gist.github.com/rmdavy/43ce9872080a2a37fe54a10a6d9b0f1c
Also take into consideration the following from Sevagas' blog on MacroPack Pro https://blog.sevagas.com/Launch-shellcodes-and-bypass-Antivirus-using-MacroPack-Pro-VBA-payloads :

Dim allocatedAddr As LongPtr ' Long or LongLong depending on architecture
#If Win64 Then
allocatedAddr = IndirectWin32Call("kernel32", "VirtualAlloc", vbLongLong, 0&, UBound(buffToInject), &H1000, &H40) ' vbLongLong is mandatory as returned address is 64bit
...
Dim nullValue as LongPtr  ' Or instead use 0^ for LongLong zero directly as function argument
nullValue = 0
result = IndirectWin32Call("kernel32", "CreateThread", vbLong, nullValue, nullValue, allocatedAddr, nullValue, 0, nullValue) 'DispCallFunc needs precise type for arguments. LongLong zero is not the same as Long zero.

This information helped me a lot for x64 Shellcode injection. I hope this makes it less time-consuming for other people in the future.

macro too many continuation

The generated vba macro is very long, the error is too many line continuation , not able to manually add the macro in the doc file.

Is it still FUD?

It seems kind of old.. Is it only possible to deploy shell code or also custom powershell code?

x86 vs x64

It could be very useful to add an option to specify the type of macro that needs to be generated (either x86 or x64) that would help avoiding tons of issues and be a time saver! 🙏🏼

Too many line continuations erro in the VBA when copying the final vba shellcode output.

Great work there. Would you be able to advise, how to resolve "Too many line continuations" error in the Macrs VBA app? new to vba and trying to understand this ;) student so be gentle on me hehehe

BadAssMacros Integrated with Vulcan

Hi @Inf0secRabbit - Just to let you know that I integrated BAM (which I find very useful despite the known open issues) with Invoke-Vulcan. Please do not hesitate to take a look and leave your feedback.

Suggestion: Add a precompiled .exe on Releases

There are guys out there who don't have Windows as main OS, and would like to download the pre-compiled version :)
Please let me know if you add the .exe
(Great project though)