outflanknl / evilclippy Goto Github PK

I use Windows 64bit office 64bit 2019
if the language is chinese the cmd "EvilClippy.exe -uu somename.xlsm" ,the module1（chiese is 模块1）became 模锟斤拷1 ie become Garbled character and you click module（模锟斤拷1） has no code AND even
CANT open the Module

When I try to execute certain commands, it gives me the error

$ EvilClippy.exe -s a.vba A.doc

未经处理的异常: OpenMcdf.CFItemNotFound: Cannot find item [VBA] within the curr
ent storage
在 OpenMcdf.CFStorage.GetStorage(String storageName)
在 MSOfficeManipulator.Main(String[] args)

When investigating a vbastomped file it is nice to know which office version/bit-ness it was created with so we know what version we can open it back up in and get office to successful decompile the pcode for us. It would be great to have a command-line option that we can use with a document and have it identify, for example:

• 2016x86
  or
• 2019x64

The current work around for not having this feature is to use the "-v" option which prints the VBA Project stream to the screen in hex, then looking at the 3rd and 4th bytes and comparing to this table from evilclippy.cs

case "2010x86": version[0] = 0x97; version[1] = 0x00; break; case "2013x86": version[0] = 0xA3; version[1] = 0x00; break; case "2016x86": version[0] = 0xAF; version[1] = 0x00; break; case "2019x86": version[0] = 0xAF; version[1] = 0x00; break; case "2013x64": version[0] = 0xA6; version[1] = 0x00; break; case "2016x64": version[0] = 0xB2; version[1] = 0x00; break; case "2019x64": version[0] = 0xB2; version[1] = 0x00; break;

I have some VBA code on GitHub. Ideally, when I change the code, and add a tag, I would like Travis-ci or Appveyor to take the code, turn it into the ole binary format, and package it into a Excel Addin in the least Evil way possible, no obfuscation or hiding anything. I’m trying to distribute some open source statistics algorithms for widely without having to create the addin on my local workstation. It seems Microsoft likes to insert identifying information about the local environment into any addin that is created.

The help gives
-n, --name=VALUE The target module name to stomp.

I can't see any documentation describing this, only the -s option for stomping.

Hi, Thank you for providing such a useful tool.
I encountered some problems in the process of using it.
I use EvilClippy.exe -s 1.vba evil1.docm to build a evil docm file.

I tested five hosts(Windows 10), but two of them had this error when I enabled the macro.

It means System error&H80004005(-2147467259), unspecified error
One is Office 2016, one is Office 2019.
The other three hosts can be opened and run normally.

Do you know the reason for this?

Run Command: evilclippy.exe -g Doc2.doc
Output was: Doc2_EvilClippy.doc
But when the developer tab is used, The vba macro code is clearly visible
Using v1.3

Is there anyway to stomp a VBA and it works on office 2010-2016? tried different ways but not getting it to work

With -u and -uu, (Set/Remove VBA Project Locked/Unviewable Protection) I am receiving the follwing error.

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly 'OpenMcdf, Version=2.2.1.2, Culture=neutral, PublicKeyToken=fdbb1629d7c00800' or one of its dependencies. The system cannot find the file specified.
   at MSOfficeManipulator.Main(String[] args)

Hello! I try to test your program, everything works fine except for Serve a VBA stomped template via HTTP. On a 2016x64 machine, I create a .doc document, insert a macro, save it as a .dot template. In the file fakecode.vba I put the first line Attribute VB_Base = "0 {00020906-0000-0000-C000-000000000046}", and then the fake vba code. I start the server, on another machine 2013x64 I open a document that loads the template over the network, the template is loaded, but when the macro starts, an error appears, the macro does not execute. What could be the problem?

HI~ , i hava one question that's , when i use code by:

Sub removeall()
Dim i, A As Integer
    For Each i In ActiveDocument.VBProject.VBComponents
        If i.Type = 1 Then
            MsgBox i.Type
            With Application.VBE.ActiveVBProject.VBComponents
                On Error GoTo ErrorHandler
                MsgBox i.Name
                .Remove .Item(i.Name)
             End With
        End If
    Next
ErrorHandler:
MsgBox "err!"
End Sub
Sub AutoOpen()
   Call removeall
   If ActiveDocument.ReadOnly = False Then
        ActiveDocument.Save
End If
End Sub
Sub Auto_Open()
AutoOpen
End Sub

What I expected was the vba code removed and .doc saved,but contrary.when i use F5 do it the vab removed .......
Can you do me a favor? Thank!

First of all, thanks for the fantastic work you have done in this. I successfully built my files, but attempting to embed the file in a rtf document recognizes the presence of macros, but doesn't run the macros. I wonder if you have any insight to this.

Hello! I am testing the program and I tried to execute "mono EvilClippy.exe -g $FILENAME" with the files qqq.docm and qqq.docx. I installed Mono, downloaded the repository and included the executable file in it. The output states the file can not be found:

"""
ERROR: Could not open file qqq.docx
Please make sure this file exists and is .docm or .xlsm file or a .doc in the Office 97-2003 format.

Could not find file "/home/ricardo/EvilClippy/qqq_EvilClippy.docx"
"""

Best regards

~/Desktop/EvilClippy-master$ mono EvilClippy.exe -s fake.vba fake.docm
Now stomping VBA code in module: ThisDocument
Now stomping VBA code in module: ģ��1

Unhandled Exception:
OpenMcdf.CFItemNotFound: Cannot find item [ģ��1] within the current storage
at OpenMcdf.CFStorage.GetStream (System.String streamName) [0x00055] in <7476b626ce624f86b578f6621106d35d>:0
at MSOfficeManipulator.Main (System.String[] args) [0x00891] in :0
[ERROR] FATAL UNHANDLED EXCEPTION: OpenMcdf.CFItemNotFound: Cannot find item [ģ��1] within the current storage
at OpenMcdf.CFStorage.GetStream (System.String streamName) [0x00055] in <7476b626ce624f86b578f6621106d35d>:0
at MSOfficeManipulator.Main (System.String[] args) [0x00891] in :0

Why does this issue occur when running EvilClippy.exe -s x.vba test.dotm

Now stomping VBA code in module: YAUP2D13ZZLO

未经处理的异常: OpenMcdf.CFItemNotFound: Cannot find item [YAUP2D13ZZLO] within the current storage
在 OpenMcdf.CFStorage.GetStream(String streamName)
在 MSOfficeManipulator.Main(String[] args)

another example cant unlock xlam add-in https://drive.google.com/open?id=1ACzR-tc5BZqvp8Wv9Ziv21EoiwX8Y3GH

I'm trying to hide the actual code in P-Code, and show a fake VBA code in the Editor, on Excel 365.

For some reason, this byte

• using 0xB2 in my target environment crashes Excel with VBA errors
• using 0xB5 shows the actual code in the Editor

Wondering if anyone has come across such a situation before?

I’ve created macrofile.dot file and started webserver with EvilClippy.exe —webserver=8080 macrofile.dot.

But dont how to do next step👇

How to create another document that points to this template document via a URL by referencing it as a template from the developer toolbar in Word?

Evilclippy gave errors when running on a .doc file. The error mentions that it could not find VBA, however, the sample file has a macro code and runs successfully as well. Below is the error:

C:\Users\user1\Desktop\Test Files\EvilClippy>..\..\..\Downloads\EvilClippy\EvilClippy.exe -r asr-bypass-word.doc

Unhandled Exception: OpenMcdf.CFItemNotFound: Cannot find item [VBA] within the current storage
   at OpenMcdf.CFStorage.GetStorage(String storageName)
   at MSOfficeManipulator.Main(String[] args)

After making a fresh new instalation of Visual Studio 2019 (Community edition), and attempting to compile this proyect, I get the following:

compression.cs(111,60): error CS1002: ; expected
compression.cs(111,78): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(123,25): error CS1002: ; expected
compression.cs(123,28): error CS1520: Method must have a return type
compression.cs(123,43): error CS1002: ; expected
compression.cs(123,50): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(174,49): error CS1002: ; expected
compression.cs(174,59): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(174,81): error CS1519: Invalid token '-' in class, struct, or interface member declaration
compression.cs(246,64): error CS1002: ; expected
compression.cs(246,84): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(320,28): error CS1002: ; expected
compression.cs(320,43): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(322,32): error CS1002: ; expected
compression.cs(322,47): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(445,44): error CS1002: ; expected
compression.cs(445,54): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(445,69): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(516,70): error CS1519: Invalid token '=' in class, struct, or interface member declaration
compression.cs(516,99): error CS1519: Invalid token '(' in class, struct, or interface member declaration
compression.cs(658,28): error CS1002: ; expected
compression.cs(711,25): error CS1002: ; expected
compression.cs(711,40): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1084,38): error CS1002: ; expected
compression.cs(1084,59): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1086,31): error CS1002: ; expected
compression.cs(1086,40): error CS1519: Invalid token '=>' in class, struct, or interface member declaration
compression.cs(1086,50): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1124,30): error CS1002: ; expected
compression.cs(1124,43): error CS1519: Invalid token '(' in class, struct, or interface member declaration
compression.cs(1124,46): error CS1519: Invalid token '=>' in class, struct, or interface member declaration
compression.cs(1124,57): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(1126,47): error CS1002: ; expected
compression.cs(1126,57): error CS1519: Invalid token ';' in class, struct, or interface member declaration

The documentation pretends that there is an option -gg to unhide code.
When one runs EvilClippy with -h, this option is not listed.

Please harmonise between documentation, -h and the actual implementation.

I downloaded the latest visual studio and am running the Developer Command Prompt for VS 2022, and I get the following error:

C:\Evil Clippy\EvilClippy-master>csc /reference:OpenMcdf.dll,System.IO.Compression.FileSystem.dll /out:EvilClippy.exe *.cs
Microsoft (R) Visual C# Compiler version 4.8.4084.0
for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.

This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240

compression.cs(111,60): error CS1002: ; expected
compression.cs(111,78): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(123,25): error CS1002: ; expected
compression.cs(123,28): error CS1520: Method must have a return type
compression.cs(123,43): error CS1002: ; expected
compression.cs(123,50): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(174,49): error CS1002: ; expected
compression.cs(174,59): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(174,81): error CS1519: Invalid token '-' in class, struct, or interface member declaration
compression.cs(246,64): error CS1002: ; expected
compression.cs(246,84): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(320,28): error CS1002: ; expected
compression.cs(320,43): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(322,32): error CS1002: ; expected
compression.cs(322,47): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(445,44): error CS1002: ; expected
compression.cs(445,54): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(445,69): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(516,70): error CS1519: Invalid token '=' in class, struct, or interface member declaration
compression.cs(516,99): error CS1519: Invalid token '(' in class, struct, or interface member declaration
compression.cs(658,28): error CS1002: ; expected
compression.cs(711,25): error CS1002: ; expected
compression.cs(711,40): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1084,38): error CS1002: ; expected
compression.cs(1084,59): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1086,31): error CS1002: ; expected
compression.cs(1086,40): error CS1519: Invalid token '=>' in class, struct, or interface member declaration
compression.cs(1086,50): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1124,30): error CS1002: ; expected
compression.cs(1124,43): error CS1519: Invalid token '(' in class, struct, or interface member declaration
compression.cs(1124,46): error CS1519: Invalid token '=>' in class, struct, or interface member declaration
compression.cs(1124,57): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(1126,47): error CS1002: ; expected
compression.cs(1126,57): error CS1519: Invalid token ';' in class, struct, or interface member declaration

Any idea what could be causing this? I'm using a Windows 10 system. Would it be possible to send me a pre-compiled version since it seems to work on your system?

run"csc /reference:OpenMcdf.dll,System.IO.Compression.FileSystem.dll /out:EvilClippy.exe *.cs"

Can you please make a Visual Studio solution file for easy compiling?

I am trying to stomp the macro code to target 32 bit Office 2016 on a Windows 10 64 bit machine.
When I stomp, I use the command -t 2016x86.
My test VM gives me the error "Sub or function not defined", despite the install being the correct target.
I hope you can shed some light on this, let me know if I can provide anything.

EDIT: I think i've figured this out. If you create a document in 64-bit version of word, and then stomp with -t 2016x86, it will give you the error message. You need to create the document with 32 bit version of Word in order to stomp targeting 32 bit. It might be helpful to document this somewhere so other people don't make the same mistake I did.

Thanks for the great tool!

hello!
I create a MS Word template (.dotm) that includes a malicious macro.On a 2016x64 VM machine.
In the file fakecode.vba I put the first line Attribute VB_Base = "0 {00020906-0000-0000-C000-000000000046}", and then the fake vba code.
when i try to run "EvilClippy.exe -s fakecode.vba -w 8080 test.dotm",there is an error i have:
ERROR: Could not open file test.dotm
Please make sure this file exists and is .docm or .xlsm file or a .doc in the Of
fice 97-2003 format.

Invalid OLE structured storage file

did i something wrong?

hello!
I create a MS Word template (.dotm) that includes a malicious macro in word 2007 on a windows machine.
In the file fakecode.vba I put the first line Attribute VB_Base = "0 {00020906-0000-0000-C000-000000000046}", and then the fake vba code.
when i try to run "mono EvilClippy.exe -s fakecode.vba -w 8080 attack.dotm" to serve the file from a ubuntu server vm.
i get an error message
ERROR: Could not open file attack.dotm
Please make sure this file exists and is .docm or .xlsm file or a .doc in the Office 97-2003 format.
Could not find file "/root/snap/EvilClippy/attack_EvilClippy.dotm"

Is there any ways to bypass the virus/malware detection of the metasploit payload documents (macros attached) with EvilClippy? Google Gmail still marks it as a virus even when I run it through EvilClippy.

I noted that 32-bit Office 365 saves macro documents with a VBA Project version of B2 00, which I didn't expect because I thought it to be associated with 2016x64 and 2019x64:
https://github.com/outflanknl/EvilClippy/blob/master/evilclippy.cs#L508

Didier Stevens wrote about this phenomenon and didn't seem to reach a conclusion on why this is:
https://isc.sans.edu/diary/Office+2021%3A+VBA+Project+Version/28150

I would have simply guessed that the same p-code compiler was carried forward from 2019, but if that were true, I would have expected the version to be AF 00 like the other recent 32-bit versions instead of the version number that has been associated with 64-bit.

By way of letting you know that O365/Office 2021 is absent from the list of valid Office versions in your switch construct, I thought I would ask if you've encountered this too and learned anything about it?

Receiving a similar issue as PinkDev1....Thte thread was closed but I copied the compile error from the post

compression.cs(111,60): error CS1002: ; expected
compression.cs(111,78): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(123,25): error CS1002: ; expected
compression.cs(123,28): error CS1520: Method must have a return type
compression.cs(123,43): error CS1002: ; expected
compression.cs(123,50): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(174,49): error CS1002: ; expected
compression.cs(174,59): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(174,81): error CS1519: Invalid token '-' in class, struct, or interface member declaration
compression.cs(246,64): error CS1002: ; expected
compression.cs(246,84): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(320,28): error CS1002: ; expected
compression.cs(320,43): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(322,32): error CS1002: ; expected
compression.cs(322,47): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(445,44): error CS1002: ; expected
compression.cs(445,54): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(445,69): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(516,70): error CS1519: Invalid token '=' in class, struct, or interface member declaration
compression.cs(516,99): error CS1519: Invalid token '(' in class, struct, or interface member declaration
compression.cs(658,28): error CS1002: ; expected
compression.cs(711,25): error CS1002: ; expected
compression.cs(711,40): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1084,38): error CS1002: ; expected
compression.cs(1084,59): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1086,31): error CS1002: ; expected
compression.cs(1086,40): error CS1519: Invalid token '=>' in class, struct, or interface member declaration
compression.cs(1086,50): error CS1519: Invalid token ';' in class, struct, or interface member declaration
compression.cs(1124,30): error CS1002: ; expected
compression.cs(1124,43): error CS1519: Invalid token '(' in class, struct, or interface member declaration
compression.cs(1124,46): error CS1519: Invalid token '=>' in class, struct, or interface member declaration
compression.cs(1124,57): error CS1519: Invalid token ')' in class, struct, or interface member declaration
compression.cs(1126,47): error CS1002: ; expected
compression.cs(1126,57): error CS1519: Invalid token ';' in class, struct, or interface member declaration

Any idea why I would be receiving this?

I've created a new document, added macro vba from msfvenom, and attempted both of the commands below.

No errors from the commands, but in both cases, the msfvenom macro is still visible in both docs.

Any suggestions?

EvilClippy.exe -g doc32.doc
Hiding module: NewMacros

EvilClippy.exe -s fake.vbs -g -r doc32f.doc
Hiding module: NewMacros
Now stomping VBA code in module: ThisDocument
Now stomping VBA code in module: NewMacros
Setting random ASCII names for VBA modules in dir stream (while leaving unicode names intact).

Hi team,
Thanks for release this great tool. I found one case it's doesn't work, please take a look. The files in the attachments is blocked with a tool call Unviewable+ from spreadsheet1.com
UnviewablePlus-Samples.zip

EvilClippy.exe -s test.vba -t 2016x64 "hello.docm"

Win10
hello.docm is sucessful，but hello_EvilClippy.docm is fail.
why?

test.vba is

Sub Workbook_Open()
MsgBox "This message comes from the P-code"
End Sub

result

Hey,
I am trying to create a stomp my macro from Unicorn with EvilClippy and based on my expectations and according to the blog, I thought most Antivirus software wont be able to identify the payload. Unfortunately Windows Defender and many others do :/. Should I use something different than Unicorn? Or maybe there are some other things I am missing out.

Thank you very much in advance!

Issue #1: Unhide modules puts all code, except Classes, in modules, i.e. Sheets, forms, etc.
Issue #2: Ribbon callbacks, i.e. iRibbonControls, are discarded when Unhide Modules is performed. iRibbonControls appear in the VBA, _VBA_Project section of vbaProject.bin, but nowhere else apparently. When you look for them in the Developer Macros ribbon command of the unhidden modules workbook, they appear with a link to the workbook with modules hidden.

I want embed the rat with MS Office where the rat is hidden in the form of .bat and .hta how to use EvilClippy to make sure that these files binds and run the exploit successfully?

this not hidding my macro code in workbook, doesn't work on this?

I can not generate the .exe file, can you upload it?

Hi.

This tool cannot bypass AV.

Is it normal?

EvilClippy.exe -urg  test.xlsm

virustotal:
https://www.virustotal.com/gui/file/2abd0d49585aa5df8331c350f3ebdb1477f07f890ca3955fcf22f2aeba2f3ee2/detection