Comments (7)
Maybe the language is a problem? I just experienced that i have to translate every single Macro 4.0 command to get this technique working.
from macrome.
This is a good question - I'll need to take a look at this. That being said, when there were cyrillic characters being used, the auto_open function was triggering fine after making it international. "Worst" case we can always flag the field as an autoopen one instead of using the string approach, but that's more easily detectable. I've got some time to do some Macrome dev coming up and I'll take a look - apologies for the VERY delayed response here but it's been a busy end-of-year.
from macrome.
Hi everyone ,
Encoutered the same issue with Excel 2013 in French, indeed the International Macro only solve partially this issue. It seems like some ""keywords"" (i.e AutoOpen) are not interpreted even if it's in a International Macro.
However when replacing "AutoOpen" in the Internaional Macro Sheet with the regional keyword (i.e : AutoOuvrir in French) this is working like a charm. -> Same with the Spanish language.
Maybe an option to choose if we want to use the default AutoOpen or not (--localized ) would be great ?
Cheers !
from macrome.
Thank you for your interest. I am also following the problem and I plan to take the time to run different tests. I will share it if I get something worthwhile.
from macrome.
Hi,
I have completed my tests. I think this problem is only valid for Turkish language Excel. I don't know if the Excel in another language is affected.
For example, here (https://twitter.com/Arno0x0x/status/1133338349710860288) @Arno0x has experienced a similar problem with the French language Excel and overcome the problem by using its French equivalent Auto_ouvrir instead of Auto_open.
In summary, the problem is not solved when only International Macro is selected. When International Macro is selected, it works when the commands in English are written into the cells and when it is run manually, but no action is triggered with Auto_open.
I tried the Turkish equivalent of Auto_open or possible equivalents, as Arno0x did but it didn't work. Microsoft does not have an official documentation on this subject. For this reason, if you wish, we can close the Issue?
from macrome.
One thing that malware authors have been doing for their side of things is going with the BuiltIn function but then having it reference a different label which is all null characters. This tends to break a lot of tooling and causes problems across the board - so maybe we can avoid this issue entirely since clearly the different regional versions of Office have localized their Auto_Open string comparisons.
from macrome.
One thing that malware authors have been doing for their side of things is going with the BuiltIn function but then having it reference a different label which is all null characters. This tends to break a lot of tooling and causes problems across the board - so maybe we can avoid this issue entirely since clearly the different regional versions of Office have localized their Auto_Open string comparisons.
Yes, you are right. There is neither a source nor a content about which languages the "Auto_open" value can be translated into and for which languages Office has support. Values for only German and French languages were found by simply translating the "Open" value. However, this is not valid for the Turkish language, it does not work. Therefore, we need to find an official source about which languages are supported (which I researched a lot, but could not find it) or a content should be added to README based on user comments.
from macrome.
Related Issues (15)
- Payload HOT 5
- error HOT 6
- Formula too long HOT 3
- Sequence contains no elements. HOT 3
- Decoy Documents can only have 1 sheet
- XOR Obfuscated Documents cannot have normal Images
- Auto_Open Obfuscation breaks auto execution on MacOS HOT 1
- i work on xlsb macro sheet (biff12) mal detect, read this xls code but noticed some record not in ms xls document , but macrome has HOT 4
- Why my xls just keep loading & stuck?
- Dotnet supported version HOT 4
- Crashes attempting to dump malicious spreadsheet HOT 8
- cobaltstrike HOT 18
- not working in Excel 2016 32bit HOT 21
- How to use msf to get reverse shell, I will crash here HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from macrome.