spoofing-office-macro
spoofing-office-macro copied to clipboard
christophetd
:fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.
Is this dead project? When I run macro on Windows 10, it will not work...
Hi I fix the issues and tried in 32bit and 64bit office at Windows10 Environment But I found `result = NtQueryInformationProcess(newProcessHandle, 0, pbi, Len(pbi), size)` doesn't work. the result is...
I have the same issue as the others. A buffer overflow at ` result = NtQueryInformationProcess(newProcessHandle, 0, pbi, Len(pbi), size)`
made a macro that combined the two macros so it works for both x64 and x86 now.
As the title suggests, I spent some time updating macro64.vba (by @py7hagoras, originally here: #5) to make it a bit easier to compare with macro.vba. This is pretty much entirely...
Metadata
Owner
Metadata
:fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.