WEBVTT 00:00:02.690 --> 00:00:03.870 In this demonstration, 00:00:03.880 --> 00:00:06.310 we're going to discuss how you can utilize templates to 00:00:06.310 --> 00:00:08.150 customize your usage of Luckystrike. 00:00:08.840 --> 00:00:12.260 We'll then follow this up by adding and utilizing a custom template. 00:00:12.740 --> 00:00:16.010 And finally, we'll look at how you can analyze the generated macro code. 00:00:17.340 --> 00:00:19.810 One of the goals with Luckystrike was to reduce some of the 00:00:19.810 --> 00:00:23.070 repetitiveness in creating these malicious Office documents. 00:00:23.540 --> 00:00:24.680 Enter the template. 00:00:24.990 --> 00:00:28.760 With templates, you can create templates that contain images, 00:00:28.960 --> 00:00:33.710 macros, and other features that you want to be able to reuse over and over. 00:00:34.140 --> 00:00:36.410 For example, with the previous two documents, 00:00:36.410 --> 00:00:39.150 it didn't contain any of the typical social engineering 00:00:39.420 --> 00:00:43.050 images that enticed the user to click on enabled content 00:00:43.040 --> 00:00:44.670 to enable those macros for us. 00:00:45.140 --> 00:00:46.630 So with templates we can do that. 00:00:46.870 --> 00:00:50.020 Here's a simple example in which I've taken an Excel spreadsheet, 00:00:50.290 --> 00:00:52.910 added an image with a very blurry invoice. 00:00:53.050 --> 00:00:55.610 This is an image I took from a real malicious Office document, 00:00:55.610 --> 00:00:57.800 by the way, and then created a banner. 00:00:58.240 --> 00:01:01.620 That social engineering that entices the user to enable this content. 00:01:01.930 --> 00:01:05.209 We can save this template and now add it to Luckystrike and use it 00:01:05.209 --> 00:01:07.190 when building our malicious Office documents. 00:01:08.190 --> 00:01:11.400 From the Luckystrike Main Menu go to Catalog Options, 00:01:12.190 --> 00:01:15.240 and from here select option four, Add template to catalog. 00:01:16.040 --> 00:01:17.060 We have to add a title, 00:01:17.890 --> 00:01:20.190 and then we have to enter the full path to the 00:01:20.190 --> 00:01:21.900 template file that we'd like to use. 00:01:22.260 --> 00:01:24.450 If you get the path wrong, Luckystrike will tell you. 00:01:25.040 --> 00:01:28.150 Otherwise, you should have the message that the template was added. 00:01:28.920 --> 00:01:31.750 Now, if we want to use this template, we can create a new document. 00:01:32.140 --> 00:01:35.210 By first going to payload options and selecting a payload, 00:01:35.540 --> 00:01:36.940 we'll create another spreadsheet, 00:01:36.950 --> 00:01:39.250 and we'll use our first payload for this example. 00:01:41.040 --> 00:01:46.040 We'll then go to option three, which allows us to generate our file. 00:01:46.430 --> 00:01:49.920 But instead of generating a new file, we'll use option three, 00:01:49.990 --> 00:01:51.150 Generate from template. 00:01:52.440 --> 00:01:54.880 You'll now be able to select the template that you just added, 00:01:55.690 --> 00:01:57.560 and if everything goes according to plan, 00:01:57.570 --> 00:01:59.050 we'll have the success message. 00:02:00.200 --> 00:02:01.350 Now in our payloads folder, 00:02:01.350 --> 00:02:04.680 we'll see that our new malicious Office document includes the word template. 00:02:05.290 --> 00:02:08.830 Opening that should reveal the use of the template we just created. 00:02:08.960 --> 00:02:12.490 Just as a reminder, if you want your templates to include macros, 00:02:12.500 --> 00:02:15.480 you can as well. And Luckystrike will just append the additional 00:02:15.480 --> 00:02:17.650 payloads to the template that you've created. 00:02:19.790 --> 00:02:20.360 Finally, 00:02:20.440 --> 00:02:23.200 what if you want to see the macro code that was generated or 00:02:23.200 --> 00:02:25.240 need to do some troubleshooting? Well, 00:02:25.240 --> 00:02:28.980 you could use any malicious Office document analysis tools, as any 00:02:28.980 --> 00:02:32.740 malware analyst would use, such as oledump, olevba. 00:02:32.990 --> 00:02:35.380 We also have some options within Luckystrike. 00:02:35.770 --> 00:02:37.180 If we look at file options, 00:02:37.190 --> 00:02:39.740 which we use to generate our malicious Office documents, 00:02:40.090 --> 00:02:44.150 the last option, option four, will write the existing macro code to file. 00:02:44.740 --> 00:02:47.510 So let's go back and we'll select a payload. 00:02:51.040 --> 00:02:55.870 We'll select our PowerShell payload and we'll use the Cell Embed‑Encrypted. 00:02:57.100 --> 00:02:58.250 Once we've entered the domain, 00:02:59.840 --> 00:03:05.500 we can go back to the Main Menu, and now we can select option three and 00:03:05.500 --> 00:03:08.200 then option four, Write existing macro code to file. 00:03:08.900 --> 00:03:09.980 What this should have done then, 00:03:09.990 --> 00:03:15.220 is just written the macro code to the macro_payload.txt 00:03:15.220 --> 00:03:17.390 file in our Luckystrike directory. 00:03:18.500 --> 00:03:20.850 If you then open up that file with a text editor, 00:03:20.850 --> 00:03:23.480 you can see the content of the macro code that was 00:03:23.480 --> 00:03:25.550 generated for the malicious Office document. 00:03:25.940 --> 00:03:28.900 So you really have a number of different ways to study and 00:03:28.900 --> 00:03:31.410 analyze the macro code that is in fact generated. 00:03:32.140 --> 00:03:32.810 And finally, 00:03:32.810 --> 00:03:36.590 to wrap things up, the last option is four, Encode a PowerShell Command. 00:03:37.240 --> 00:03:39.900 This just simply encodes a PowerShell command using 00:03:39.900 --> 00:03:42.050 the base64 capability of PowerShell. 00:03:42.940 --> 00:03:45.160 If you enter command and then hit enter, 00:03:45.430 --> 00:03:48.270 you'll see that essentially all it does is takes your original 00:03:48.270 --> 00:03:51.990 command, base64 and codes it, and then generate some additional 00:03:51.990 --> 00:03:55.770 PowerShell in order to execute that. The encoded command is also 00:03:55.770 --> 00:03:56.750 saved to your clipboard. 00:03:57.480 --> 00:03:58.010 Excellent. 00:03:58.020 --> 00:04:00.440 Now that you have a good understanding of payloads, 00:04:00.440 --> 00:04:05.040 catalogs, file options, templates, and how to encode some PowerShell commands, 00:04:05.330 --> 00:04:08.750 let's go ahead and discuss how we can utilize some more realistic payloads.