In this demonstration,
we're going to discuss how you can utilize templates to
customize your usage of Luckystrike.
We'll then follow this up by adding and utilizing a custom template.
And finally, we'll look at how you can analyze the generated macro code.
One of the goals with Luckystrike was to reduce some of the
repetitiveness in creating these malicious Office documents.
Enter the template.
With templates, you can create templates that contain images,
macros, and other features that you want to be able to reuse over and over.
For example, with the previous two documents,
it didn't contain any of the typical social engineering
images that enticed the user to click on enabled content
to enable those macros for us.
So with templates we can do that.
Here's a simple example in which I've taken an Excel spreadsheet,
added an image with a very blurry invoice.
This is an image I took from a real malicious Office document,
by the way, and then created a banner.
That social engineering that entices the user to enable this content.
We can save this template and now add it to Luckystrike and use it
when building our malicious Office documents.
From the Luckystrike Main Menu go to Catalog Options,
and from here select option four, Add template to catalog.
We have to add a title,
and then we have to enter the full path to the
template file that we'd like to use.
If you get the path wrong, Luckystrike will tell you.
Otherwise, you should have the message that the template was added.
Now, if we want to use this template, we can create a new document.
By first going to payload options and selecting a payload,
we'll create another spreadsheet,
and we'll use our first payload for this example.
We'll then go to option three, which allows us to generate our file.
But instead of generating a new file, we'll use option three,
Generate from template.
You'll now be able to select the template that you just added,
and if everything goes according to plan,
we'll have the success message.
Now in our payloads folder,
we'll see that our new malicious Office document includes the word template.
Opening that should reveal the use of the template we just created.
Just as a reminder, if you want your templates to include macros,
you can as well. And Luckystrike will just append the additional
payloads to the template that you've created.
Finally,
what if you want to see the macro code that was generated or
need to do some troubleshooting? Well,
you could use any malicious Office document analysis tools, as any
malware analyst would use, such as oledump, olevba.
We also have some options within Luckystrike.
If we look at file options,
which we use to generate our malicious Office documents,
the last option, option four, will write the existing macro code to file.
So let's go back and we'll select a payload.
We'll select our PowerShell payload and we'll use the Cell Embed‑Encrypted.
Once we've entered the domain,
we can go back to the Main Menu, and now we can select option three and
then option four, Write existing macro code to file.
What this should have done then,
is just written the macro code to the macro_payload.txt
file in our Luckystrike directory.
If you then open up that file with a text editor,
you can see the content of the macro code that was
generated for the malicious Office document.
So you really have a number of different ways to study and
analyze the macro code that is in fact generated.
And finally,
to wrap things up, the last option is four, Encode a PowerShell Command.
This just simply encodes a PowerShell command using
the base64 capability of PowerShell.
If you enter command and then hit enter,
you'll see that essentially all it does is takes your original
command, base64 and codes it, and then generate some additional
PowerShell in order to execute that. The encoded command is also
saved to your clipboard.
Excellent.
Now that you have a good understanding of payloads,
catalogs, file options, templates, and how to encode some PowerShell commands,
let's go ahead and discuss how we can utilize some more realistic payloads.