Welcome to Initial Access with Luckystrike.
My name is Dr Josh Stroschein, and I'll be your instructor for this course.
Luckystrike brings all your pain in one macro.
This is a tool created by Jason Lang, also known as Curious Jack,
and is designed to be an all‑in‑one solution for
managing your malicious Office documents.
It will allow you to use templates,
add and manage different payloads, and includes
features to help with antivirus evasion.
So, what is Luckystrike?
Well, it's a PowerShell framework,
so we're going to need a host that allows you to run PowerShell.
I'll primarily be using a Windows 10 virtual machine for this course.
The source code is available on GitHub, as well as the
documentation and an issue tracker.
So if you run into any issues,
a good place to start will be to look at the documentation and
then to review any issues to see if anyone's already submitted
the issue that you're seeing.
Of course,
you can also submit your own issue and look for help that way. The main
purpose of this tool is to generate malicious Office documents, and you'll
see as we get into the tool itself, that it is primarily up to you to decide
how to add the payloads that will be the functionality that the malicious
Office document actually entails.
I'll demonstrate a couple of popular frameworks to help with this.
We'll also discuss how you can use templates.
So, for example,
you can create a malicious Office document that uses one of your favorite
social engineering images or images that may be tied to a certain campaign,
add those to the system, and then reuse those templates so that you don't
have to add the image manually every time.
As I mentioned, how effective you are utilising Luckystrike
will come in your ability to add payloads,
and we'll get into the details throughout the course.
Finally,
there are some antivirus evasion techniques. Generating
malicious Office documents and testing that they're able to
not only bypass any security tools,
but also the techniques that they are leveraging will become very important,
and how successful your malicious Office documents will really boil down
to how effective they are bypassing the security tools.
If we look at malicious Office documents in relation to the kill chain,
you'll see that they typically fall somewhere between exploit and escalate as
part of the C2. While some malicious Office documents can in fact use and
exploit in order to achieve code execution, oftentimes they're relying on the
host and its already inherent capabilities,
such as the use of PowerShell or simply straight macros, in order to
execute code and callback to a command and control node to receive the
next stage payload and further instructions.
It's at this point that the attacker has the initial
foothold into the environment,
and it's now up to the rest of your red team tools and
frameworks in order to escalate, move laterally,
evade detection, and perform any desired actions in the target environment.
Let's now take a look at MITRE ATT&CK and see where our tool
fits in. For malicious Office documents,
they fall under initial access or technique T1566 Phishing,
sub‑technique T1566.001 Spearphishing Attachment.
A common use case scenario with malicious Office documents is to send them
as an attachment to an email against an organization,
whether that's very broadly or very targeted against specific users.
The goal is to get that malicious Office document in front of the user
and to have them enable the content to execute the macros, or in the
case that it contains an exploit, to open the document so that the
exploit could be utilized.
So let's go through this scenario in a little bit more detail. If we
begin with our malicious Office document being sent to a target
organization, if that Office document is able to bypass any security
tools or initial email filtering,
then it makes it into the in box of our unsuspecting user.
If our malicious Office document has made it this far,
we may have some additional security to consider, oftentimes the
endpoint security running on the host itself.
If the malicious Office document has been crafted in a way that it
can avoid detection from the endpoint security,
then our user has the ability to interact with it.
If that user opens the document and enables the content, now
they've provided that initial foothold, the entry point for the
attacker, into that environment.
The malicious Office document will drop its initial payload,
which will connect back to the adversary C2, and now the adversary has
the ability to start performing its next stage goals,
such as privilege escalation, moving laterally,
establishing persistence, and setting up for the next phase of the attack.
In this course, I'll be using two virtual machines.
The first will be a Windows 10, which will be my primary
for installing and utilizing Luckystrike.
The second will be Kali Linux,
and we'll use that later in the course to help generate some payloads
that we can use within the Luckystrike framework.
Now that you have a high‑level understanding of what
Luckystrike is as a framework and the capabilities that can
provide you as a penetration tester,
let's get hands‑on with several demos that will gain you proficiency in
utilizing Luckystrike to generate your malicious Office documents.