In this demonstration, we're going to discuss payloads and catalogs.
We're going to create a maldoc using the shell command, and then
we'll create another maldoc using custom PowerShell.
Let's get started.
Let's begin by loading Luckystrike.
You'll notice from the main menu that you have four
primary options: Payload Options, Catalog Options,
File Options, and then Encode a PowerShell Command.
The first three are the most important for getting started,
and the process that we're going to go through in order to
create our first malicious Office document will be first to
create a payload by adding it to a catalog.
Then we'll select that payload and then finally generate
our new malicious Office document.
Keep in mind as you create these malicious Office documents that you can add
any number of payloads in your catalog to those documents.
They'll be executed in sequence and can allow for more attack vectors per
malicious Office document to increase the chances of success.
Let's get started by selecting option 2, Catalog Options. You'll
see that we have two main sections here, PAYLOADS and TEMPLATES.
We'll get to TEMPLATES here in just a moment. With PAYLOADS, we
have three options.
We can add a payload to the catalog,
remove the payload from the catalog, or show catalog payloads. Being
that this is the first time we've run Luckystrike on this host, our
catalog currently contains no payloads.
Now let's select option 1, Add payload to catalog.
You'll begin by defining the title, and I'm just going
to simply pop calc using a shell.
You'll have a couple of optional arguments, the Target
IP, the Target Port, and a Description.
And I'm going to leave those all blank for now.
You have your payload type. And for this payload,
I'm going to choose option 1, the Shell Command.
Finally, you enter in the payload text. That is, what command do you want to
run? We're going to just enter in calc.exe. You should see after entering in
the command that the payload was added. Now we're ready to go back a menu in
the navigation, so enter in option 99.
At this point, we need to select our payload.
So, from the main menu, we'll select option 1, Payload Options.
Here we have very similar menu options, Select,
Unselect, or Show selected payloads.
If we select option 3, Show selected payloads, you'll see a message
that indicates no payloads have been selected.
So even though we just added one to the catalog, we haven't selected it yet.
We need to select the payload in order to add it to the
malicious document that we're creating.
So let's choose option 1. Before we select a payload though,
we need to determine which document type we wish to make,
whether that's an Excel spreadsheet, xls, or a Word document,
doc. We'll go with an Excel spreadsheet.
From there, we can select our payload.
We only have one payload to select, so we'll enter item 1.
And now we have to choose the infection method.
This will be a shell command.
You can see the payload has now been added.
If we had additional payloads, we could continue to add those at this point.
Since we're done though,
we can enter an option 99 and go back to the previous menu.
We're now ready to create our malicious Office document,
so we need to go back one more menu to get to the main menu.
At this point,
we want to select option 3, File Options. Here we have a
number of choices: generate a new file,
update an existing file, generate from template. write
existing macro code to file, or go back.
We're going to select option 1, Generate new file.
If everything worked correctly,
you should see a Success message, as well as the location where
this new malicious Office document was created.
This is going to be in a subdirectory called payloads
underneath the main luckystrike folder.
If you navigate to the luckystrike payloads folder,
you'll find your malicious Office document. We'll also likely
want to verify that it works by double‑clicking on the document
and seeing if calc will be popped.
As is a common configuration with Office,
there'll be a banner, a security warning saying that macros have
been disabled and that the user can enable the content by clicking
this button. We'll go ahead and do that and see that our
calculator has in fact been popped.
For our next example,
we're going to use some PowerShell that does a very common malicious
activity, that is to download a file from a host,
drop it to the file system, and execute it. One of the
requirements of Luckystrike is that any provided PowerShell
scripts need to be unobfuscated for usage.
To view this PowerShell script, I'm using the Windows Power Shell ISE.
There are three lines here.
The first defines the destination.
This is just to get the location of the user's temp directory,
typically under AppData/Local/Temp, and provide an arbitrary name for the
executable, AdobePlugin.exe. Start‑BitsTransfer is one of many ways in which we
can download content over the internet using PowerShell.
Here we provide the source,
and I'm just using an executable that I've hosted on
my own website and the destination.
Finally,
we can use Start‑Process to execute the file that
we've just retrieved and downloaded.
So, how can we utilize PowerShell?
Well,
we'll go back to the main menu, and we'll begin by selecting Catalog Options.
From there, we'll add a new payload to the catalog.
We'll call this Calc via PowerShell.
We don't need any of these optional arguments.
I'm going to skip the description for now. And for the
payload type, we'll choose a PowerShell script.
The last thing that we have to enter is the full path to the ps1 file,
the PowerShell script that we just created.
And now we can go back in the menu in order to select this payload
to create our next malicious Office document.
You'll notice that at the Select Payload screen we have our
previous payload, as well as our new payload.
Those have been added to the catalog. For now,
since they both ultimately do the same thing, I'm just going to
select the new payload that we just created.
As we choose different payload types, we'll have
different infection method options.
And at the end of this demonstration,
I will show you a way in which you can study the payloads themselves.
That way, you can understand better how they're being
obfuscated to help you avoid AV.
For this example, let's just choose option 1, Cell Imbed.
This will show us that our payload has been added.
We now can go back to the previous menu, and if you had additional
payloads you wanted to add to this document,
you could. However,
we're just going to add this single payload, so we'll go back one
more menu to the main menu, and now we're ready to choose option
3, File Options. And this will allow us to generate our new file
by selecting option 1.
Our malicious Office document should now be ready in the payloads folder.
As with our previous maldoc, we can go to the payloads folder,
double‑click the malicious Office document, and
confirm that it is working as expected.
And there's Calc, confirming that our malicious Office document is working as
expected. While popping Calc a great way to begin to understand how the
framework works and see that our payloads are in fact executing, we're going
to want to move on to more advanced usage,
and we'll do that in the upcoming demonstrations.