Just like embedding a malicious code into a PDF file, you can easily embed a malicious macro code into
an EMS office document such as an s word.
To create a malicious word document, we should prepare a macro code and the payload, which is used
by the macro.
Let's prepare a malicious word document using the Métis Void Framework and Vayle framework, the steps
of this example will be.
Creating a malicious executable, converting the malware into a macro code which is ready to be embedded
into an office document.
Creating the office document.
Embedding the script code is a macro and concatenating the payload as text, starting a listener to
listen to the sessions of the victims who opened the office document.
Opening the document is a victim.
Collecting the session as the attacker.
Now let's do it first, create a malicious executable using Vayle.
I'll take it faster now because we've already done this before.
Remember, please refer to our creating custom payloads with Vayle Lecture Chew's list in the main menu
type.
Use one to use evasion tool type list to list available payloads.
Let's use payload 27.
Setting the listener host is enough at the minimum.
And generate give the name initials for the outpost files.
Choose the executable creation method.
OK, malicious, executable is created.
Let's test our malware to see if it's working, transfer the file to the victim machine.
Now here I have a Windows eight system as victim.
I'm going to use the win capital to transfer the file.
And of course, we have to find a reasonable way to do it.
Phishing, malicious website, visit, et cetera.
Copy the malware into the SSA, choose your home folder for ease of use.
Run win SICP.
Connected to the Caleigh machine.
And transfer the file to the Windows desktop.
Start a handler to collect the session, go to Caleigh and start the MSF console with the Dasha parameter
and use the RC file produced by Vayle.
Handlers started is at the background.
With the session dash l command, we see that no session is in progress at the moment, run the malicious
executable in the Windows system, we now have a valid session of the Windows system.
Use the sessions dashi session ID command to interact with the session.
Our malware is working like a charm.
Now, let's kill the session for now, because this was just a test of the malware is working well.
Sessions Kay, Uppercase K will kill all the open sessions.
Now we'll create a visual basic script using our malicious executable file.
We're in the Calli machine, so find the location of the exact two VBA script using Locate Command in
Linux.
Go to the folder.
And Ron Exacta Vrba Ruby script, the script needs to parameters to run.
First, the malicious executable with full path, which will be converted to a macro code.
Second, the name of the output file.
The script is created, now is the time to create the malware embedded word document, go to the Windows
machine, which is the system of the victim, and transfer the micro file using wind SICP.
Let's open the Dot Vrba file using a notepad, I'm using notepad plus plus for this purpose because
the dot VBA file is a bit big and notepad plus plus has a much better memory management than the native
notepad application in Windows.
There are two parts in the dark VBA file.
First part is the McKerracher, second part is the payload that will be used by the macro to create
the Metro Aperture Session.
Now, start using my word and create a new word document, by the way, do you wonder why I use Windows
eight, an office 2013?
Because I have their licenses and no others.
Create a macro under view, tab, select macro's, view macros, give a name and click the create button.
I'm using the word application of office 2013, if you use a different version, your menus might differ.
Please Google it to find the location.
Open our doors, Vrba file and copy the macro code part and paste it into macro code page.
Save the changes and close the page.
And we have malicious macro codes inside the document.
Now, we still have to embed the payload into the document.
Go to the DOT, VBA file, copy payload data part.
And pasted into the word document, we have quite a big payload, and I confess it's bigger than I expected.
This is because we used Vail to create a custom malware and we chose interpretor, which is a complex
one.
Wait until the paste is finished.
It could take 15 to 20 seconds.
To make the documents seem like a regular document.
You can shrink the font size, for example, make it one.
And you can make the font color of the payload white.
Then save the file.
To succeed in this attack, Ms word application has to be configured to run macro codes.
In MS word, all macros are disabled by default, so you have to convince the victim to enable the macros
as well.
In file menu, select options.
Select Trust Center, Click Trust Center settings, button and tick enable all macro's option, click
OK at the lower right corner.
Now we have a macro enabled MS word.
Be sure the handler is running at the moment.
Opened the word document we created, it may take some time because the document is a big one.
Wait a few seconds.
You have a new session for the victims system.
Congratulations.