KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #typescript #ai-agent #developer-tools #claude-code #codex #deepseek-harness #ai-agents #cli #react #mcp

Invoke-NoShell

★ 33 Open GitHub ↗

All the Power with no Shell

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Invoke-NoShell
Invoke-NoShell outputs a Microsoft Office Word .doc file with an embedded macro.
It allows the automation of multiple similar versions of files, allowing to test how slight differences will effect it.
Currently, only PowerShell payloads are supported.

The tool was launched at BSidesTLV 2018 and significantly improved for BSidesLV 2018, you may find the presentations from both cons in this repository.

## Parameters
Invoke-NoShell has 4 optional parameters:
```
-docPath [-D] Full path for the output file.
-payloadPath [-P] Full path of a text file containing PowerShell payload to embed
-docGenerationMod [-M] A or M - for auto or manual payload generation mode
-lureText [-T] Text to be displayed in the doc for the unsuspecting victim
```

## Usage Example 
Create all 13 possible permutations with the lure text "open sesame" armed with the PowerShell script 
```
Invoke-NoShell.ps1 -M A -T "Open sesame" -P c:\MyPowershellz\payload.ps1
```

Create a single document, manually select all the parameters
```
Invoke-NoShell.ps1 -M M
```

Create all 12 possible permutations in the folder C:\MyDocsFolder
```
Invoke-NoShell.ps1 -D C:\MyDocsFolder -M A
```

## Prerequisites
You need to have Microsoft Office installed in order to run this script.
The script will set the following key in order to allow automatic interaction with Word:
```
HKEY_CURRENT_USER\Software\Microsoft\Office\<OfficeVersion>\Word\Security\AccessVBOM
```
The tool was tested with Windows 10 x64, Office 2016 and PowerShell 5.0 but should work on other setups as well.

## //TODO:
Pull requests are welcomed:
+ One of the permutations is generated incorrectly at the moment, fixing it will require some refactoring.
+ Adding more features for generating the document, resulting in more permutations, for example - adding built-in obfuscation features.
+ Removing redundant functions written to the macro and never executed.
+ Improving the OLE logic for including restrictions on its execution as well.
+ Adding arguments for testing a specific "manual" payload from the command line.
+ <s>Alert on common VBA limits - lines longer than 1024 chars and non-ASCII chars.</s>

## References
Credit for Word COM object basics:  
https://learn-powershell.net/2014/12/31/beginning-with-powershell-and-word/

HKCU execution policy bypass trick:  
https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/

PowerShell ISE script loading documentation:  
https://docs.microsoft.com/en-us/powershell/scripting/core-powershell/ise/how-to-use-profiles-in-windows-powershell-ise

Invoke-NoShell

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README