WEBVTT 00:00:01.840 --> 00:00:04.340 Welcome to Execution with macro_pack course. 00:00:04.580 --> 00:00:05.050 In here, 00:00:05.060 --> 00:00:09.470 you'll learn how to hide malicious executable files into Microsoft Office 00:00:09.470 --> 00:00:13.800 files. In this course, we'll talk a lot about masquerading, 00:00:14.040 --> 00:00:17.250 and the idea of masquerading is hiding malicious files into a 00:00:17.250 --> 00:00:21.340 legitimate file, so then your victim will not suspect about it and 00:00:21.340 --> 00:00:24.830 will open the file, and this idea of masquerading is really important 00:00:24.830 --> 00:00:27.200 in the red team engagement. For example, 00:00:27.280 --> 00:00:30.910 imagine that you work in a financial company, then one day you 00:00:30.910 --> 00:00:33.550 receive an email that looks like from one of your directors, 00:00:34.040 --> 00:00:35.870 and the email says something like, hey, 00:00:36.030 --> 00:00:38.050 can you take a quick look at the attached report? 00:00:38.740 --> 00:00:42.290 Most people would look at the attachment file and not suspect anything, 00:00:42.490 --> 00:00:44.250 since it's just an Excel spreadsheet. 00:00:45.140 --> 00:00:48.650 A lot of people think that malware is only in executable files, 00:00:49.040 --> 00:00:53.170 but they forget that Office files can also contain malware. So 00:00:53.170 --> 00:00:56.280 then, you go and open the Excel spreadsheet, and from what you 00:00:56.280 --> 00:00:57.980 see the spreadsheet looks normal, 00:00:58.280 --> 00:01:01.670 but in reality the hacker was able to get a shell to your computer, 00:01:01.990 --> 00:01:04.450 and now the attacker has full control of your laptop. 00:01:05.740 --> 00:01:07.930 What is happening on the background is that the Excel 00:01:07.930 --> 00:01:10.050 spreadsheet had a macro script in it. 00:01:10.540 --> 00:01:11.840 If you're not familiar with macros, 00:01:11.950 --> 00:01:15.810 basically they are a piece of software written in Visual Basic that can 00:01:15.810 --> 00:01:20.560 be hidden in a Microsoft Office application such as Word or Excel, and 00:01:20.560 --> 00:01:24.090 then when someone opened the Excel file, the Visual Basic script is 00:01:24.090 --> 00:01:25.850 executed without you knowing about it. 00:01:27.530 --> 00:01:30.850 In theory, you can write your own malicious payload in Visual Basic 00:01:31.230 --> 00:01:33.650 and then manually include that in any Office file. 00:01:34.140 --> 00:01:36.380 However, there is a smarter way of doing that, 00:01:36.450 --> 00:01:38.350 which is using the macro_pack tool. 00:01:39.070 --> 00:01:43.250 This tool allows you to hide malicious payloads into Microsoft Office files, 00:01:43.840 --> 00:01:47.250 and the best part is you don't even need to know how to code in Visual Basic. 00:01:48.340 --> 00:01:51.510 The macro_pack tool was developed by Emeric Nasi, which 00:01:51.510 --> 00:01:53.250 is a famous cyber security researcher. 00:01:53.790 --> 00:01:54.520 And thanks to him, 00:01:54.610 --> 00:01:56.930 I can save a lot of time when I need to masquerade some 00:01:56.930 --> 00:02:01.210 malicious payloads, so thanks Emeric. Also, check out his 00:02:01.210 --> 00:02:04.100 Twitter and his other work. He has some really good publications 00:02:04.110 --> 00:02:05.950 on how to bypass detection systems. 00:02:07.320 --> 00:02:10.360 The macro_pack is a tool to automate obfuscation and 00:02:10.360 --> 00:02:11.940 generation of Office documents, 00:02:12.150 --> 00:02:16.770 Visual Basic scripts, shortcuts, and other formats. As you see in 00:02:16.770 --> 00:02:18.750 this course, we can do a lot with this tool. 00:02:20.740 --> 00:02:23.880 What I like about macro_pack is that it's an open source tool, meaning 00:02:23.880 --> 00:02:27.450 that you can download it and customize it if you want. You can find the 00:02:27.450 --> 00:02:32.770 tool at this GitHub page. As I mentioned, this tool is focused on 00:02:32.770 --> 00:02:36.170 automating the incorporation of malicious code into Microsoft Office 00:02:36.170 --> 00:02:37.400 files, or in other words, 00:02:37.590 --> 00:02:40.450 this is a tool that will help us to masquerade malicious files. 00:02:41.140 --> 00:02:44.930 And this tool will help us to exploit the easiest point of entering a company, 00:02:44.970 --> 00:02:49.380 which is people. Knowing how to craft a convincing phishing email 00:02:49.460 --> 00:02:51.550 is a really important skill for a red teamer, 00:02:52.240 --> 00:02:56.150 and with macro_pack, you increase your chance of success in a phishing attempt. 00:02:58.500 --> 00:03:01.230 If you're familiar with the red team kill chain, we can make the 00:03:01.230 --> 00:03:04.650 macro_pack tool to both exploit and privilege escalation. 00:03:05.440 --> 00:03:06.050 For example, 00:03:06.060 --> 00:03:08.610 we can use masqueraded malicious files to phish an 00:03:08.620 --> 00:03:12.850 HR person to get their account, and after getting access to their account, 00:03:12.930 --> 00:03:16.130 we can try to send malicious files to admins, so then 00:03:16.140 --> 00:03:17.650 we can escalate their privileges. 00:03:19.820 --> 00:03:20.240 Also, 00:03:20.250 --> 00:03:23.330 if you're familiar with the MITRE ATT&CK framework, we can map this 00:03:23.330 --> 00:03:28.510 course to two main errors, initial access and execution. Instead of 00:03:28.510 --> 00:03:33.010 execution, we'll cover user execution, and more specific, this 00:03:33.010 --> 00:03:34.850 subcategory, malicious files, 00:03:35.440 --> 00:03:39.480 which means we'll get access to the systems by making our victim execute a 00:03:39.480 --> 00:03:43.940 malicious file that we will be sending to them. The second technique that 00:03:43.940 --> 00:03:47.580 we'll cover is command and scripting interpreter languages, and more 00:03:47.580 --> 00:03:50.250 specific, we'll cover the Visual Basic language. 00:03:51.010 --> 00:03:54.860 And this means that our payload will be generating Visual Basic, and this 00:03:54.860 --> 00:04:00.890 malicious code will be masqueraded into a legitimate file. Inside of 00:04:00.900 --> 00:04:05.570 initial access, we cover the phishing technique, or more specific, the 00:04:05.570 --> 00:04:07.750 spearphishing attachment. Basically, 00:04:07.760 --> 00:04:10.380 we'll take the malicious files that we created and send to 00:04:10.380 --> 00:04:12.450 our victim via attachment in an email. 00:04:15.640 --> 00:04:17.660 But before getting to the technical part to this course, 00:04:18.050 --> 00:04:21.610 I want you to keep in mind that performing any of those attacks without 00:04:21.610 --> 00:04:25.380 authorization is illegal in most of the countries, and this means if you 00:04:25.380 --> 00:04:27.550 send malware to someone to try to hack them, 00:04:27.770 --> 00:04:28.890 you may go to jail, 00:04:29.160 --> 00:04:31.560 especially if entering their computer or their account. 00:04:31.560 --> 00:04:33.050 It's definitely a criminal offense. 00:04:34.140 --> 00:04:34.610 Also, 00:04:34.620 --> 00:04:37.160 you should be really careful when performing any attack that 00:04:37.160 --> 00:04:39.450 impact the customer environment, for example, 00:04:39.460 --> 00:04:43.020 our malicious payload in the Office file may affect the laptop of our 00:04:43.020 --> 00:04:47.390 victim, and I'm sure that the CEO would not be happy if his computer 00:04:47.390 --> 00:04:48.850 goes down because of a security test. 00:04:49.340 --> 00:04:52.870 So make sure the client is okay with you performing such attacks, 00:04:53.190 --> 00:04:55.150 and make sure you have everything formalized. 00:04:57.000 --> 00:05:00.360 Also, it is really important to stay legal, so first, 00:05:00.370 --> 00:05:01.950 if you're working a red team project, 00:05:02.040 --> 00:05:04.400 make sure you have a letter of engagement from the client 00:05:04.720 --> 00:05:07.530 detailing the dates that the test will be executed, as well 00:05:07.530 --> 00:05:09.250 as the types of attacking scope. 00:05:10.340 --> 00:05:13.760 And also it is important to have a formal document signed by the client, 00:05:13.960 --> 00:05:16.520 detailing and authorizing the attacks that you'll be performing. 00:05:17.100 --> 00:05:20.460 And this document is what differentiates a criminal from a professional red team 00:05:20.460 --> 00:05:25.500 specialist. And, as a personal recommendation, always consult the client before 00:05:25.500 --> 00:05:27.750 executing any attack that may impact the network. 00:05:28.240 --> 00:05:30.550 So, bottom line, don't be a criminal. 00:05:32.640 --> 00:05:34.870 So let's take a minute to understand the attack that we'll be 00:05:34.870 --> 00:05:38.910 performing here. First, imagine you're working a red team engagement 00:05:38.980 --> 00:05:41.450 and you have to compromise a financial institution. 00:05:42.300 --> 00:05:45.020 So then we will create a legitimate Excel file that 00:05:45.020 --> 00:05:46.350 looks like a real spreadsheet. 00:05:47.240 --> 00:05:51.250 Then we also create a malicious payload that we want our victim to execute. 00:05:51.940 --> 00:05:52.620 In my case, 00:05:52.680 --> 00:05:55.730 I will use a reverse shell payload, and this means that 00:05:55.730 --> 00:05:57.400 when the victim executes the file, 00:05:57.680 --> 00:06:00.980 the malicious script will connect back to my attacking machine and 00:06:00.980 --> 00:06:03.150 give me shell access to the victim computer. 00:06:04.640 --> 00:06:07.550 So, okay, we have a legit file and a malicious payload. 00:06:08.140 --> 00:06:12.060 Then, the next step is to use the macro_pack tool to combine both 00:06:12.060 --> 00:06:16.400 files into one file, and this means that the final file will look 00:06:16.400 --> 00:06:20.290 exactly like an Excel spreadsheet, but when the user opens it, my 00:06:20.290 --> 00:06:21.450 payload will be executed. 00:06:22.440 --> 00:06:24.150 Once we have our masqueraded file, 00:06:24.160 --> 00:06:27.790 we'll put it into a convincing phishing email and then we'll send it to our 00:06:27.790 --> 00:06:33.010 victim. Once the victim opens the file and execute the macros in the document, 00:06:33.010 --> 00:06:37.390 we'll get a reverse shell in our attacking machine, and this means that we'll 00:06:37.390 --> 00:06:39.250 have full access to the victim computer. 00:06:40.040 --> 00:06:40.950 That's pretty cool, right? 00:06:41.440 --> 00:06:43.240 Even though this might seem a simple attack, 00:06:43.370 --> 00:06:45.750 you'd be surprised on how this works in a lot of cases, 00:06:46.500 --> 00:06:49.650 especially if a victim is a known IT person the chance of 00:06:49.650 --> 00:06:51.290 them opening this file is really high. 00:06:53.140 --> 00:06:55.900 So if you want to get the most out of this course, I do recommend 00:06:55.900 --> 00:06:58.600 you having a small lab environment so you can practice those 00:06:58.600 --> 00:07:01.750 attacks. In here, I'll be using two machines. 00:07:02.480 --> 00:07:04.280 One is our attacker machine, 00:07:04.320 --> 00:07:08.080 which can be a Windows 10 or a Kali Linux machine, and 00:07:08.080 --> 00:07:11.300 the other one is our target machine, which is our victim computer. 00:07:12.010 --> 00:07:15.050 In this case, they should be running Windows or Windows Server. 00:07:15.940 --> 00:07:18.480 Also, as we are working with Microsoft Office files, 00:07:18.710 --> 00:07:22.750 both attacker and victim machines should have Microsoft Office installed. 00:07:23.540 --> 00:07:24.380 So, okay, 00:07:24.390 --> 00:07:26.790 enough of talking, let's go to our lab and see how 00:07:26.790 --> 00:07:28.150 this attack is done in real life.