64 bit compatibility

[tanujain]

Hey I am trying to use the VB macro on 64-bit machine O365 but looks like it's not compatible. It gave some ptrsafe errors. I fixed them by adding ptrsafe to the declare statements but then I got some ByRef errors. I also tried converting long to longptr as suggested in some articles for converting 32 nit vb to 64 bit. Is there any chance that you can provide 64 bit version or any tips to fix the errors?

[christophetd]

Hi,

As indicated in the readme, I tested this PoC on Windows 10 64 bits - can you provide your OS and office version?

Thanks

[tanujain]

I am trying it on Windows 10 and Office 365 MSO (16.0) 64-bit.

[cha0tic87]

+1

This doesn't work with 64-bit Office. The typedefs need modifying and I also don't think the getPidByName() function words for 64-bit processes. The latter I can get around with WMIC but I'm unsure how to modify the typedefs or function declarations for 64-bit.

Niiiice work on the 32-bit though.

[christophetd]

Hi,

Thanks for the update. I double checked, and indeed the Office version I own is a 32-bit version... Apologies for the confusion. I have updated the README to reflect this.

If someone could contribute to a 64-bit version, that'd be awesome - I do not have access to a 64-bit Office version at the time.

[cha0tic87]

Looking for any progress by anyone on this. Personally I've got to the point where the parent PID spoofing on x64 works, but the argument spoofing does not. There are no errors from any of the API calls, and I believe the issue is currently with the call to WriteProcessMemory(), but I don't know how to debug further.

[christophetd]

What I would suggest to do is:

• Put a breakpoint just before the call to WriteProcessMemory
• Using Process Hacker, dump the PEB (cf https://blog.christophetd.fr/wp-content/uploads/2019/03/PH-mapped-PEB.png), say to a file named peb1.bin
• Execute the call to WriteProcessMemory
• Dump the PEB again in peb2.bin
• Do a diff peb1.bin peb2.bin to see if anything was written to the PEB, and if yes what changed. You can PM me the files on Twitter if you'd like me to take a look

[py7hagoras]

@christophetd I submitted a pull request yesterday for the 64 bit implementation. Tested it with Office 365 (2016) 64-bit on 64 bit system. Learnt a lot while doing this.

[christophetd]

Merged! (#5)