Now that we have access to the user's inbox,
we could use this as a launchpad to do some internal phishing.
So let's first have a look at how we could use
MS Word.
So let's create a new blank document.
And you can obviously put anything you want inside the
actual document body.
I'm not gonna dress it up for the sake of the video,
but what we want to do is go to view and macros and
change this to document one, which is the current document.
And again, let's give the document a name
and use auto open because this will trigger as soon as the
document is opened.
And let's just replace this with a very simple,
bit of VBA that will run Notepad.
So we can test this with this little play button,
and you can see that Notepad,
has launched.
Now the easiest type of payload that we can put in here to
spawn a beacon is the PowerShell payload.
So let's go back to Cobalt Strike,
and let's go to attacks,
scripted web delivery.
The URI path can be anything you want.
I'm just gonna leave it as a.
The host, I'm gonna put as, nickel viper dot com.
And the listener is the HTTP listener.
The payload that we want to generate is a PowerShell
payload, and we want it to be sixty four bit.
So when we click launch, this will
generate a stageless PowerShell payload,
and it will host it on Cobalt Strike's team server so that we
can download it over the Internet.
It then gives us this very nice one liner that we can,
copy
and
paste into the macro.
Now because we have,
a set of out quotes here,
we have to put an additional set here and here.
And if you want, you can remove this, port eighty bit.
That's literally all we have to do.
So this will launch PowerShell,
which will then download the payload from this URL,
and it will, execute it in memory using
the, IEX or invoke expression,
cmdlet.
So let's close this. We can go to file, save.
And I'm gonna save this into my payloads folder,
and I'll change the type to dot doc.
And I will just call it reports.
And hit save.
Now what you can do is you can go to,
site management and manage, and this is
where the PowerShell payload is hosted.
If you want to remove it, you can hit kill.
We could have also done this manually by going to site
management and host file,
selected the
let's see, the PowerShell payload that we'd already generated
and given it
a URL and hit launch.
The only difference with doing it through the scripted web
delivery is it gives us that one liner for us to copy and paste.
Okay.
Now that we have this document safe, let's just close it,
and we will compose a new email.
We're gonna send this to,
Bob Farmer.
And I'm just gonna attach it directly to the
email.
Let's just say, please review.
Obviously, in a real, phishing campaign,
you'd be putting a lot more effort into making these things look legit.
This is just, the, I guess, the,
technical overview of the payloads.
And let's hit send.
And then once it's out of drafts,
we can then
go back over to the dashboard,
and we're going to open the console of workstation two.
K. This will log in as, Bob Bob Farmer.
So we can go ahead and launch
Outlook.
And we have the, the email.
So let's,
open the document.
And the user has to click on this enable content to, enable macros.
A good strategy that a lot of, people use is
some content in the document that says, hey.
This document has been protected by some sort of
security product, and you have to click
enable content, enable to see it.
You can also
include additional macros that, when enabled,
you know, the content is actually just being unlocked.
But either way, they have to click this.
And then you briefly see the PowerShell window open and vanish.
If we go back to the
our desktop,
we now have a beacon running as Bob
Farmer on workstation two.