Having written a few posts and demonstrated some different methods of bypassing AMSI using VBA, here’s another small post demonstrating another technique which I found is possible as a result of some Advanced Googling… I was studying the courses by Sektor7 (all of which I recommend) and one of the topics covered is run timeContinue reading VBA and Function Pointers
This write up is based upon the work of Matt Graeber @Mattifestation https://gist.github.com/mattifestation/ef0132ba4ae3cc136914da32a88106b9 Tools Used IDAhttps://www.hex-rays.com/products/ida/support/download_freeware/ Windbghttps://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools If we load up amsi.dll in IDA or equivalent tool and start looking at AmsiScanBuffer we can see that there is a check to see if the value which is pointed to via rbx equals 49534D41h (AMSI). IfContinue reading AMSI in the HEAP x32
My previous couple of posts have all been centred around VBA, AMSI and Macros. This isn’t going to be different!. This makes for the easiest AMSI and Windows Defender bypass. Whilst reading through MSDN, which incidentally makes great bedtime reading…., I read that it was possible to use ordinal numbers with VBA when declaring functionsContinue reading Ordinal Numbers and VBA can be fun – who knew!
My previous post covers walking the PEB using VBA within a x32 version of Microsoft Office. Upon reflection, I realised that my previous post could be more detailed so I thought I’d address the x64 version and try and cover some of the bits I left out. For anyone who wants a little more backgroundContinue reading Walking the PEB with VBA x64
A few months back I wrote a post about some work my colleague and I did about patching AMSI with VBA. Whilst AMSI bypasses aren’t new, we put a little twist on it by dynamically calculating the address in memory which needed patching, at that point, I also hadn’t seen a working example in VBA.Continue reading Walking the PEB with VBA