‫OK, let's have another example of the Empire project.
‫This time, we're going to create a macro to prepare a malicious office document at this point, we
‫already have a listener.
‫So I jump to the stage your generation step.
‫Type used, Stager put a space character and press tab twice to see all of the available stages, and
‫we use Windows Macro to create a macro which will open a back door into the victim's machine type,
‫use stager windows, macro and hit enter.
‫Type info to see the options, we have to set the listener now type set listener, my HTP listener,
‫or if you gave it another name to the listener, type it, leave the other options with the default
‫values.
‫Run.
‫Execute command, generate the macro, the macro is generated in the temp folder temp folder with the
‫name of macro.
‫Let's go to the temp folder and look at the file using Cat Linux Command.
‫Select and copy the macro code.
‫Now it's time to create the malicious office file using this macro code.
‫We're now in a Windows system.
‫I'm going to create a word document.
‫Open a new document from the View tab open macro window.
‫Paste a macro code that we copied in Cali, save and close the macro window.
‫The macro code is not in the clipboard of your victim windows machine.
‫I mean, if you cannot paste the macro code in Windows system, copy paste action may not be allowed
‫by your virtualization platform.
‫VMware VirtualBox etc.
‫Don't worry, there are lots of ways to bring the macro code in.
‫For example, you may change the configuration of your virtualization environment to allow copy paste
‫between the virtual machines.
‫Another method is sending the code to yourself in an email so you can open the email and the victim's
‫machine and copy the macro code.
‫Now, of course, to be able to see the effects of our code, the macro has to be enabled in the victims
‫office tool.
‫Now I'm using an Office 2013 to enable macros.
‫I follow the Path File Options Trust Center Trust Center Settings and click Enable All Macros, then
‫the OK button.
‫Save the word document on the desktop and close now the document has the macro code inside and the macros
‫are enabled in the office tool.
‫Now I want to touch on two topics here.
‫First, as you can see in the right hand corner of the screen, I'm going to open the malicious document
‫while Windows Defender is running.
‫So we'll see if we can bypass the security systems or not.
‫Second, of course, we don't expect the victim to prepare the fire themselves.
‫We are testing the document that we prepared.
‫Sending it to victims and convincing them to open the files is another case.
‫Now open the word document, it seems everything's fine.
‫Something abnormal doesn't appear.
‫Let's go to our Cal system, as you see, we have a new agent initialized.
‫Go to the main menu using main command.
‫There was one agent at the beginning.
‫Now we have two of them.
‫Go to agents state using agents command.
‫The second one is our new session, which started when the victim open the word document.
‫Use interact command with the agent named Activate the Session.
‫Now, the victim machine is in your hands.