‫Just like embedding a malicious code into a PDF file, you can easily embed a malicious macro code into
‫an MS office document, such as as word.
‫To create a malicious word document, we should prepare a macro code and the payload, which is used
‫by the macro.
‫Let's prepare a malicious word document using the Metasploit Framework and Veil Framework, the steps
‫of this example will be.
‫Creating a malicious executable, converting the malware into a macro code which is ready to be embedded
‫into an office document.
‫Creating the office document.
‫Embedding the script code is a macro and concatenating the payload as text, starting a listener to
‫listen to the sessions of the victims who open the office document.
‫Opening the document is a victim.
‫Collecting the session as the attacker, now let's do it first, create a malicious executable using
‫veil.
‫I'll take it faster now because we've already done this before.
‫Do remember, please refer to our creating custom payloads with veil lecture.
‫Choose List in the main menu type.
‫Use one to use evasion tool type list to list available payloads.
‫Let's use payload 27.
‫Setting the listener host is enough at the minimum.
‫And generate give the name initials for the outpost files.
‫Choose the executable creation method.
‫OK.
‫Malicious executable is created.
‫Let's test our malware to see if it's working.
‫Transfer the file to the victim machine here.
‫I have a Windows eight system as victim, I'm going to use the win as a tool to transfer the file.
‫And of course, we have to find a reasonable way to do it.
‫Phishing, malicious website, visit, etc..
‫Copy the malware into the SSA, choose your home folder for ease of use.
‫Run win FCP.
‫Connect to the Cali machine.
‫And transfer the file to the Windows desktop.
‫Start a handler to collect the session.
‫Go to Carly and start the MSV console with the d'assurer parameter and use the RC file produced by Vale.
‫Handler started is at the background.
‫With the session Dash L Command, we see that no session is in progress at the moment.
‫Run the malicious executable in the Windows system.
‫We now have a valid session of the Windows system.
‫Use the session's Dash II Session ID Command to interact with the session.
‫Our malware is working like a charm.
‫Now, let's kill the session for now, because this was just a test if the malware is working well.
‫Sessions, Dash K Uppercase K will kill all the open sessions.
‫Now we'll create a visual basic script using our malicious executable file.
‫We're in the calling machine, so find the location of the exec to VBA script using Locate Command in
‫Linux.
‫Go to the folder.
‫And run exact to VB, a Ruby script.
‫The script needs two parameters to run.
‫First, the malicious executable with full path, which will be converted to a macro code.
‫Second, the name of the output file.
‫The script is created now is the time to create the malware embedded word document.
‫Go to the Windows machine, which is the system of the victim and transfer the micro file using win
‫as copy.
‫Let's open the Dot VBA file using a notepad.
‫I'm using Notepad Plus Plus for this purpose because the Dot VBA file is a bit big and Notepad Plus
‫Plus has a much better memory management than the native notepad application in Windows.
‫There are two parts in the dark VBA file.
‫The first part is a macro curve.
‫Second part is the payload that will be used by the macro to create the Metro operator session.
‫Now, start using MS word and create a new word document, by the way, do you wonder why I use Windows
‫eight and Office 2013 because I have their licenses and no others?
‫Create a macro and review tab, select macros.
‫View macros.
‫Give a name and click the Create button.
‫I'm using the word application of office 2013, if you use a different version, your menus might differ.
‫Please Google it to find the location.
‫Open our dot VA file and copy the macro code part and paste it into macro code page.
‫Save the changes and close the page.
‫And we have malicious macro codes inside the document.
‫Now we still have to embed the payload into the document.
‫Go to the Dot VBA file copy payload data part.
‫And pasted into the word document, we have quite a big payload, I confess it's bigger than I expected.
‫This is because we used veil to create a custom malware and we chose Moteur Printer, which is a complex
‫one.
‫Wait until the paste is finished, it could take 15 to 20 seconds.
‫To make the document seem like a regular document.
‫You can shrink the font size, for example, make it one.
‫And you can make the font color of the payload white.
‫Then save the file.
‫To succeed in this attack, MS word application has to be configured to run macro codes in MS word.
‫All macros are disabled by default, so you have to convince the victim to enable the macros as well.
‫In file menu, select options.
‫Select Trust Center, click trust center settings button and tick.
‫Enable all macros option, click OK at the lower right corner.
‫Now we have a macro enabled MS Word.
‫Be sure the handler is running at the moment.
‫Open the word document we created, it may take some time because the document is a big one.
‫Go to Carly.
‫Wait, a few seconds.
‫You have a new session for the victims system.
‫Congratulations.