> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/persistence/office-templates.md).

# Office Templates

It's possible to persist in the userland by abusing Microsof templates - documents that are used as base templates for all new documents created by Office. In this lab, I am abusing Ms Word templates.

## Weaponization

Let's open and edit the base template called `Normal` that can be found at:

```
C:\Users\mantvydas\AppData\Roaming\Microsoft\Templates
```

![](/files/-Li2zsDQ05O2kciVhYsE)

Create a new AutoOpen macro and add your VBA code there:

```javascript
Sub AutoOpen()
MsgBox "Ohai from the template :)"
End Sub
```

![](/files/-Li30PlZTpOU4c5yucuZ)

Save the template and exit. We're now ready to create a new document, save it and launch it - at this point, we should get our VBA code executed. Below GIF shows exactly that:

![](/files/-Li30gD8VQws4gKB3sFR)

## References

{% embed url="<https://www.mdsec.co.uk/2019/05/persistence-the-continued-or-prolonged-existence-of-something-part-1-microsoft-office/>" %}