This demo is a continuation of the previous demo, where we were executing
the attacks developed earlier in this course. For this demo, we're testing
the macro payload on our Windows 10 host.
Our first step is to copy the text from our powershell_attack.txt file.
We can go ahead and stop our HTTP server, and then we use the same command as
the previous demo to start our listener with Metasploit.
Now that our other listener is ready, we can head back to our Windows 10 target.
Normally, you would copy and paste the text into a Microsoft
Office file of your choice as a macro.
Even a free one‑month trial of Office requires a credit card to sign up and
could charge you if you forget to cancel, so to maximize everyone's
capability to follow along in this demo risk free,
I'll adopt this to OpenOffice, which is free.
Open a new document with OpenOffice, and then go to Tools,
Macros, Organize Macros, OpenOffice Basic.
Now we need to create a new macro. For that, under the name of our
document, we just hit New, we can leave the default name,
Module1, and that will open the editor.
Now we just paste in our PowerShell content above the main module. For our
modifications, all we have to do is delete VBA from the front of CreateObject,
and then we have to change Application.Quit to stardesktop.terminate. If you
want, you can change the message text here to change the way the message box
is displayed and not mention Microsoft Office, but I'm just going to leave it
default for here.
This, as written, will execute and not be detected by Defender.
We will unfortunately run into the same issues as the
previous example with Windows Defender monitoring runtime
execution. Without the custom shell code,
there is one other workaround.
This will work, but as you will see,
the convincing phishing attack is on another level because you will
need to run the application as an administrator.
We can control Windows Defender using PowerShell, so if we add
another PowerShell command to our macro,
we can use the command Set‑MpPreference, and set
‑DisableRealtimeMonitoring to true.
Let's add that before our shell. We can use the same set of variables to
try to further obscure this from Windows Defender.
These variables here will enable PowerShell to run and
leave it obscured like it is above.
Then we just add our command. Make sure the PowerShell window doesn't appear.
We also need to add windowStyle to this command.
Alright, so with this command we'll actually disable Windows
Defender shortly before running our exploit.
But we are going to need to give that some time to run, so let's actually create
a second message box that pops up between when this command takes effect and
when our exploit actually runs. To do that, we're actually going to take these
variable declarations down here and move them up. Then we can use these two
lines to create a second message box.
We'll go ahead and rename this to msg2, and then we'll change this
message to just say that there was an error.
Alright, now that are macro is finished, we'll go ahead and
save this, and then close the macro editor.
And next we're going to go ahead and save a copy of this file.
The reason for saving a copy is that our next step is to make
this macro execute when the document is opened.
We want to have a copy so that we have something to edit that when we
open it won't execute our macro every time. I'm going to call this
file test2. Now that we've saved a copy,
let's go ahead and make this macro payload execute when the
file is opened. To do that, we go to Tools, Customize, go to
Open Document, and assign our macro.
And then just click OK, and save it again, and we're all set for our test.
So we'll go ahead and close this out. Now remember for this next part
we're going to need to run OpenOffice as administrator, and we open our
document, test2. And we have our first message, just give that a second,
and we see that Windows Defender is turned off. And then we have our
second message, and if we click OK, the document closes.
And then back on Kali we have our shell.
So both of our attacks developed with Unicorn succeeded. For a
quick recap of what we covered in this lesson,
we executed both of our attacks that we developed earlier in this course.
We tested out our HTA on the Metasploitable 3 machine,
and we modified our macro to work with OpenOffice and
successfully ran it against our Windows 10 host.