error

[shtry]

Does not work on office16 and 2019. x64 bit.

A crash occurs and it exits.

my command:

 ./Macrome build --decoy-document Docs/decoy_document.xls --payload Docs/popcalc.bin --payload64-bit Docs/popcalc64.bin

build file:
poc.zip

[michaelweber]

I know it's been a while, but if you use the new release at https://github.com/michaelweber/Macrome/releases/tag/v0.4.1, does it work? Make sure you use the new argument --payload-method base64 - this is a MUCH more stable way to embed payloads, and it might fix issues you're having here.

[aaaddress1]

I meet the same issue too. use the default command, and generate a file output.xls, but Excel 2019 got crash when open it.

[michaelweber]

I need to update the documentation - try it with the --payload-method base64 flag as well - so like Macrome build --decoy-document decoy_document.xls --payload popcalc.bin --payload64-bit popcalc64.bin --payload-method base64.

I've also made some fixes in the main branch as well, so if the 4.1 release doesn't work, try pulling down the repo and running it using dotnet run from the download directory. I'm going to cut a new release for this in a few days just in case.

[michaelweber]

I've updated the documentation and the latest release to automatically base64 encode payloads now - give that a try with your payload and see if it works without a crash.

[0xElessar]

@michaelweber amazing work! Thank you for the tool and sharing it. Much appreciated.

BASE64 option fixes the problem on Office 2019. Awesome!

[michaelweber]

Fantastic! Glad this fixed the issue - closing the issue now.

Happy hunting out there!