WEBVTT

00:00:01.740 --> 00:00:02.210
Hey there.

00:00:02.220 --> 00:00:03.750
Welcome back to our lab environment.

00:00:04.340 --> 00:00:06.350
Now that you know the basics of macro_pack,

00:00:06.440 --> 00:00:09.150
I want to show you one more interesting feature of this tool.

00:00:10.140 --> 00:00:13.950
Instead of embedding a malicious code into the Microsoft Office file,

00:00:13.950 --> 00:00:15.950
we can create a dropper file.

00:00:16.880 --> 00:00:20.850
A dropper is basically a file that does not contain any malicious code in it.

00:00:21.390 --> 00:00:21.800
Instead,

00:00:21.810 --> 00:00:24.620
what a dropper does is to connect to a remote server

00:00:24.760 --> 00:00:26.790
and download the payload from there.

00:00:26.790 --> 00:00:30.950
And then after downloading it, the dropper executes in the victim computer.

00:00:31.840 --> 00:00:35.950
The difference here is that a malicious code is not stored in the Excel file.

00:00:36.540 --> 00:00:37.000
Instead,

00:00:37.180 --> 00:00:39.960
the Excel file will only connect to the server and then

00:00:39.960 --> 00:00:41.650
download the malicious code from there.

00:00:42.880 --> 00:00:44.930
So let's say I create my own malware.

00:00:44.930 --> 00:00:49.250
In our case, it's this one here called malicious.exe.

00:00:50.140 --> 00:00:52.340
Instead of putting this malware inside of an Excel

00:00:52.340 --> 00:00:54.060
spreadsheet and send to the victim,

00:00:54.260 --> 00:00:57.460
I'll create a dropper that connects to my server and then

00:00:57.460 --> 00:01:00.450
download the malicious.exe from a remote server.

00:01:01.740 --> 00:01:03.210
So okay, let's get started.

00:01:03.210 --> 00:01:07.850
First I need to create an HTTP server where my malicious file will be hosted.

00:01:08.640 --> 00:01:10.360
And there are several ways of doing that,

00:01:10.360 --> 00:01:14.450
but I think the easiest one is using a Python HTTP server.

00:01:15.340 --> 00:01:18.350
So let me open the command terminal with admin privileges,

00:01:19.990 --> 00:01:22.890
and then let me go to the folder where my malware is stored.

00:01:25.000 --> 00:01:30.670
And then in here let me start a Python HTTP server. For that I type

00:01:30.780 --> 00:01:38.550
python then ‑m, which means module, and then http.server.

00:01:39.940 --> 00:01:40.560
After that,

00:01:40.580 --> 00:01:43.140
all I have to do is put the port that I want to my server

00:01:43.140 --> 00:01:46.950
to run. In my case, I'll put port 8080.

00:01:47.940 --> 00:01:48.510
Perfect.

00:01:48.790 --> 00:01:50.750
The Python HTTP server is now listening.

00:01:51.440 --> 00:01:54.950
Just as a test, I will open my browser and try to access it.

00:01:56.240 --> 00:01:59.950
So I put in my IP address here and then port 8080.

00:02:01.340 --> 00:02:02.250
Awesome, it works.

00:02:02.410 --> 00:02:06.250
As you can see, I can access the files from that folder via the browser.

00:02:06.720 --> 00:02:11.600
And this means that the server is ready. Now the next step is

00:02:11.600 --> 00:02:16.000
to create our dropper file. For that, let me use this command

00:02:16.000 --> 00:02:18.250
here. First I'll type echo,

00:02:18.840 --> 00:02:24.060
and then between double quotes I'll put the URL to my malicious file. And

00:02:24.070 --> 00:02:26.550
very important, don't forget to put the port here too.

00:02:27.440 --> 00:02:32.060
After that I'll put which name I want the temporary file to be called, and

00:02:32.060 --> 00:02:34.820
this will be the name of the file in the victim machine.

00:02:35.180 --> 00:02:37.580
Personally, I suggest you put in something not suspicious.

00:02:38.240 --> 00:02:41.850
So here I'll call non‑malicious.exe.

00:02:43.210 --> 00:02:46.890
Now that we have the URL set up and the name of the file that I want to save,

00:02:47.120 --> 00:02:53.000
all I have to do is put a pipe and then I use the macro_pack.exe followed

00:02:53.000 --> 00:02:58.680
by the option ‑t to specify that I want a DROPPER file, and then the option

00:02:58.820 --> 00:03:05.240
‑o to specify that I want obfuscate the code, and ‑g to specify the name of

00:03:05.250 --> 00:03:11.380
my output file, which I will call important‑spreadsheet.xls. Perfect. When

00:03:11.380 --> 00:03:16.030
I execute this, macro_pack will create an Excel file that will connect to

00:03:16.030 --> 00:03:20.230
my Python HTTP server and download the malicious file to the victim

00:03:20.230 --> 00:03:20.750
computer.

00:03:22.210 --> 00:03:25.370
Now all I have to do is craft a really good phishing

00:03:25.370 --> 00:03:27.320
email and send this to my victim.

00:03:27.700 --> 00:03:29.280
And again I will leave this part to you.

00:03:31.080 --> 00:03:34.430
So we're here in the victim computer. In here I already have

00:03:34.430 --> 00:03:36.450
the malicious spreadsheet in my desktop.

00:03:37.240 --> 00:03:41.850
So let's open this file. And then as usual, let's enable the content.

00:03:44.550 --> 00:03:45.220
Take a look.

00:03:45.460 --> 00:03:46.850
It seems nothing is happening, right?

00:03:47.540 --> 00:03:51.150
You might think that this failed, but let's open the Task Manager,

00:03:52.470 --> 00:03:58.630
and let's go to the top Details to see what is running. Perfect, take a look.

00:03:59.000 --> 00:04:00.450
That's my malware running in the background.

00:04:01.040 --> 00:04:03.460
That's very cool, right? Again, in less than 10 minutes,

00:04:03.510 --> 00:04:07.980
we created a dropper that downloads malware from a remote server and executes it

00:04:07.990 --> 00:04:10.650
in the victim machine without the person knowing about it,

00:04:11.040 --> 00:04:12.050
and that's really interesting.