Hey there.
Welcome into our lab environment.
So just to show you my current lab environment,
I created two virtual machines here.
This one with the dark theme is the attacker machine,
and this other one here with the lighter theme is the victim machine.
Both of them are Windows 10 machines with Microsoft Office installed.
Since they are identical virtual machines,
I set up different colors for them so I know which one is
the attacker and which one is the victim.
The attacker machine, which is this dark one,
has disabled the Microsoft and anti‑virus,
as well as the Windows firewall,
and the idea here is it will be dealing with a lot of malicious payloads.
So it is important that no anti‑virus is present,
while you create your malicious files.
Also, in the attacker machine, I already installed the Metasploit framework.
And if you're not familiar with Metasploit,
just a quick Google search, and you'll how to install that on your computer.
So, let's get started.
First, we need to download the macro_pack tool.
For that, let's visit the macro_pack Github.
In here,
let's scroll down and go to this link that contains the Windows binaries.
Perfect!
In this page,
I will download the executable file for the latest version of macro_pack.
Then, to save us time,
I already had downloaded this file and saved it into this folder here.
As you can see, I have the macro_pack.exe file, which is our binary file.
And also, I have a malicious.exe file, but let's not worry about this now.
We'll use this file later in this demo.
So let's execute macro_pack.
For that, let me open the terminal,
and then let me navigate to the folder where I have macro_pack.
Perfect!
As you can see, I have macro_pack in here.
Just as a test, let's run macro_pack.exe and then ‑‑help,
and this will give us the Help page of macro_pack.
And it's also good away to test if everything is working fine.
Awesome!
As you can see, I've got here the Help page, so we're good to go.
Let's get started by showing what a macro_pack is capable of.
For example, let's say I want to embed a command into an Office file.
For example,
let's say that I want to open the Windows calculator
when the victim has opened axl file.
For that, I'll use this command here.
First, I'll use echo, and then the command that I want to execute,
in my case it's calc.exe, which is the Windows calculator.
But here I could use any command that I want.
So you can imagine how powerful this is.
Then I use pipe, and then I use macro_pack.exe.
After that, I used ‑t CMD ‑o, and then ‑G,
and after that, the name of the output file.
So let's take a minute to understand this.
The ‑t is to specify the type of payload that I'm using here.
In my case, it is a command payload.
The ‑o is a flag to enable code obfuscation,
meaning that the Visual Basic code will be obfuscated in the Excel spreadsheet.
And then the ‑G is to specify the name of the output file,
which I'll call calc.xls, since I want the axl file.
Perfect!
When I run this, macro_pack will create a temporary
script file with my command in it.
And then we incorporate this script file into the Excel spreadsheet.
And once that is completed, I have in my file a folder called calc.xls.
So let's open it.
Perfect!
Take a look.
This looks like a normal file.
The only difference here is a security warning for macros,
but when I enable the macros, my script will be run in the background.
And as you can see, the calculator is open on the background.
Now imagine what you could do with this.
You could hide any command into an Excel spreadsheet,
and the victim would not even know what's happening.
Now, let's go for a more interesting example,
Let's say I want to masquerade a Meterpreter reverse shell into a Word document.
In this way, when the victim opens the file,
I would get access to their computer.
So let's see how that's done.
As I mentioned, I already have Metasploit installed on this machine.
So I'll use the tool MSFvenom to create my malicious payload.
And if you're not familiar,
MSFvenom is a tool to create malicious payload for Metasploit.
Then I use the option ‑p, which is to specify the malicious payload that we want.
In my case, I will use the Windows 64‑bit Meterpreter reverse shell.
After that,
I should also put the option LHOST to specify the IP of my attacker machine,
and then use the flag ‑f with vba to specify that I want a Visual Basic script.
Perfect!
This command will generate the payload.
Now,
all I have to do its pipe this into the macro_pack tool and
use the flag ‑o to obfuscate the code, and then ‑G to specify my output file,
which in here I'll call reports.doc.
Perfect!
Once I execute this,
the MSFvenom will generate the Visual Basic payload that
contains the Meterpreter reverse shell,
and this payload will connect to my attacker machine and
give me show access to the victim machine.
And after the payload is generated,
macro_pack will masquerade this malicious code into a Microsoft Excel file.
And this may take a few minutes.
So I will speed up this video to save us some time.
And we're done.
To make this more convincing, I can open this file and edit the content.
For example, we can make this look like a real report,
or we can simply write something like,
this report could not be loaded; enable macros to continue.
Most people when seeing this message,
will go ahead and click on the Allow Macros button.
So let's just save this file and close Microsoft Word.
Now that we have our malicious file already,
we need to set up a Metasploit listener for this malicious payload.
So in here, I'm assuming you already have some experience in Metasploit,
but if not, feel free to pause this video and understand what I'm doing.
So first, I will open the Metasploit using the MFS Console.
Then I will use this generic exploit handler.
And then I will set the payload type as the same
payload I used with the MSFvenom, which is windows/x64/meterpreter/reverse_tcp.
Done.
Now let me set the LHOST variable, which is my attacker IP, and we are done.
All that we have to do this type run and press Enter.
Awesome!
As we can see, the Meterpreter listener is up and running.
Now that we have our malicious payload ready and we
also have the listener ready,
all that we have to do is writing a convincing phishing email to our
victim and put the malicious report as an attachment.
And I'll leave this step for you.
So let's go to our victim machine now.
In here, I have the malicious report that we created.
In theory, the victim doesn't even need to save the file on the disk.
They only need to open the file.
So let's go ahead and open the report.
In here, hopefully,
the victims will fall for this message and click on the Enable Content button.
And if they do, nothing will happen.
For the victim, it seems that nothing changed,
and usually the person will just close the document and move on with their life.
But now let's go back to the attacker machine.
Here, take a look.
In the Metasploit listener, it says that I have one new session,
meaning that our payload worked.
Now let me open a shelter victim machine.
Now, I'm in control of the victim machine.
And if you look closely,
you see that I have the same permissions as the user that executed the file.
And that's perfect.
In just a few minutes, we were able to generate a malicious report,
continue our Word shell, and then get a shelter victim computer.