Another way we can leverage Word is through remote template injection.
So back on my, attacking VM, I'm gonna create a
new, blank document.
And I'm gonna create exactly the same macro as
in the previous example,
like so.
And this time, when I save it,
I'm going to
template format dot dot,
And I'll make sure we're in payloads,
and I'll save it as template dot dot.
And then close this.
And then in Cobalt Strike, site management host file,
and we're gonna select template dot dot.
I'll keep the same name,
and then hit launch.
And then this gives us the URL of the file.
So that template file is now being hosted on the team server.
So now we want to go into the documents folder and then
custom office templates.
And in here, you'll see a blank template.
So let's just, double click on that to create a new template or a new document we
could
add some, content to it just to make it look nice.
Otherwise, I'm just gonna go to file, save as.
I'll call it report again, but this time,
I'm gonna save it as a docx,
and then just close it.
And then if we go to the payloads directory
and then find the report,
we can right click it and open it in seven Zip.
So seven Zip open archive.
We then want to go into Word and then Rails,
and then right click on this settings XML file,
and say edit.
If we scroll along a little bit,
you'll see, this entry here.
So because this document was created from a template,
it, maintains the path to that template,
inside it.
And what we want to do is replace this target with
the URL
of the, malicious, template
like so.
So what will happen is that when this document gets opened,
it will download the template document from this URL.
So let's, save
and say, okay.
And then let's just email it
to Bob again.
And off it goes.
Now if we go to
view and then web log,
you can see, incoming hits for things that we have hosted on the, web server.
So if we go to workstation two
and open the document,
Back on the,
web log, we can see that template dot dot has been requested.
And it has been, been, downloaded by this document.
And it gives us some warnings about macros again.
But if we, enable content the same as before,
we get the beacon.