> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/initial-access/phishing-with-ms-office/phishing-embedded-html-forms.md).

# Phishing: Embedded HTML Forms

In this phishing lab I am just playing around with the POCs researched, coded and described by Yorick Koster in his blog post [Click me if you can, Office social engineering with embedded objects](https://securify.nl/blog/SFY20180801/click-me-if-you-can_-office-social-engineering-with-embedded-objects.html)

## Execution

![](/files/-LLP0QqjMQH0JmxAI59j)

{% file src="/files/-LLP0dJuTS\_RdHPctpvr" %}
Forms.ps1
{% endfile %}

{% file src="/files/-LLP0Y2tVNXrOS-qoqjp" %}
Forms.docx
{% endfile %}

## Observations

These types of phishing documents can be identified by looking for the CLSID 5512D112-5CC6-11CF-8D67-00AA00BDCE1D in the embedded `.bin` files:

![](/files/-LLP11w7b5dwx2QN9I6C)

...as well as inside the activeX1.xml file:

![](/files/-LLP0Pamd6EwRl-1AWn4)

As usual, MS Office applications spawning cmd.exe or powershell.exe should be investigated:

![](/files/-LLP1VLs6A-1Aq2xHze7)

## References

{% embed url="<https://securify.nl/blog/SFY20180801/click-me-if-you-can_-office-social-engineering-with-embedded-objects.html>" %}