inject-macro | Inject VBA macro code into Excel documents | Reflection library

inject-macro is a PowerShell library typically used in Programming Style, Reflection applications. inject-macro has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

Inject-Macro allows for the injection of VBA macros into Microsoft Excel and Word documents; specifically targeting the 97-2003 '.xls' and '.doc' file format due to their ability to contain VBA macros without having a '.xlsm' or '.docm' file extension. Inject-Macro requires an Excel or Word file, specified with '-Doc', and a plain text VBA macro file, specified with '-Macro'. The macro will be injected into the document and file metadata such as the last author will be removed. This is intended to be a quick way to prepare a templated Excel or Word document with a macro payload. If the '-Infect' flag is given, the supplied VBA macro will be injected into all Excel or Word documents found in the user specified '-Doc' directory path. Inject-Macro will read the first line of the user supplied macro and look for 'Auto_Open' or 'AutoOpen'. Excel uses 'Sub Auto_Open()' to automatically run macro code when the documet is opened; Word uses 'Sub AutoOpen()'. This will determine if the macro will be injected into Excel or Word documents. The VBA 'Security' registry keys are disabled and not re-enabled on exit when using the '-Infect' flag. This removes that pesky 'Macros have been disabled.' warning, and executes the macro without prompting the user. Additionally, the 'LastAccessTime', 'LastWriteTime' and 'Author' file properties of the document are initially copied and replaced after injection to make the file appear untouched. Ideally this would be used to establish a low level form of persistence. For clean-up, the location of all injected documents are written to '$env:temp\inject.log' when running Inject-Macro with the '-Infect' flag. If the '-Clean' flag is given, the VBA macro code will be removed from the documents and the registry keys will be re-enabled.