Locked VBA-RunPE - How to bypass application whitelisting

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

A VBA implementation of the RunPE technique or how to bypass application whitelisting.

Description

A simple yet effective implementation of the RunPE technique in VBA. This code can be used to run executables from the memory of Word or Excel. It is compatible with both 32 bits and 64 bits versions of Microsoft Office 2010 and above.

Tests

This code was tested on the following platforms:

    Windows 7 Pro 32 bits + Office 2010 32 bits
    Windows 7 Pro 64 bits + Office 2016 32 bits
    Windows 2008 R2 64 bits + Office 2010 64 bits
    Windows 10 Pro 64 bits + Office 2016 64 bits

This is the hidden content, please

• Sign In
• or
• Sign Up