TLDR:
Just experimenting with different ways to load CLR (.NET) assemblies on VBA locally and remotely by using AppDomain.ExecuteAssembly or any other handy method after getting arround AccessVBOM (programmatic access to visual basic project is not trusted) from VBA.
vba2clr.*.vba:- Sets
AccessVBOMregkey to 1 - Instantiate a
Word.ApplicationCOM object. (could beExcel.ApplicationMS PowerPoint, Access ..etc). - Add Macro From String (Macro corresponds to b64/hex encoded ExecuteAssembly.vba)
- Run ExecuteAssembly.vba Macro using
wordObj.Application.Run...
- Sets
.NET from VBA:
-
ExecuteAssembly.clr.2.0.vba: Up to .NET 3.5- Adds the required mscordlib references
- Instantiates the required objects (
IDomain,ICRHost) - Pack the required
AppDomain.ExecuteAssemblyarguments into two separate arrays (variables, types). - Use DispCallFunc to call
AppDomain.ExecuteAssembly(Arg1, Arg2)(VFTable offset 51) whereArg1is the ".NET Assembly URL" or "Local Path" andArg2is the return value. - AppDomain methods VFTable offsets can be checked on the AppDomain IDL _AppDomain.idl, just keep in mind that the AppDomain interface inherits from the IUnknown interface, so functions/methods VTable offsets start from the third offset onwards, this is because interfaces inheriting from IUnknown have the first 3 entries in their vtable set to
QueryInterface,AddRef,Releasemethods. - WinDbg or IDA can be also used as alternatives for extracting functions/methods VTable offsets.
-
ExecuteAssembly.clr.x.vba: supports .NET 2, 3.5 and 4.x
OPSEC Notes:
- Creating a COM object for
Word.Application(orExcel.Application..etc), will result spawning an additionalWinWord.exeas a child process of svchost.exe instead of the mainWinWord.exeprocess. AccessVBOMRegistry key is modified/restored via COM usingWScript.Shell, using win32 APIs could be a better alternative.- Hosting the CLR using win32 APIs on VBA is obviously safer than updating the
AccessVBOMregistry key, will leave this for an other day... - Other .NET APIs such as
System.CodeDom.Compilercan be used to compile/execute c# code from VBA, check reference below;