WEBVTT 00:00:01.140 --> 00:00:04.960 This demo is a continuation of the previous demo, where we were executing 00:00:04.960 --> 00:00:09.900 the attacks developed earlier in this course. For this demo, we're testing 00:00:09.900 --> 00:00:12.260 the macro payload on our Windows 10 host. 00:00:13.540 --> 00:00:17.760 Our first step is to copy the text from our powershell_attack.txt file. 00:00:20.040 --> 00:00:25.000 We can go ahead and stop our HTTP server, and then we use the same command as 00:00:25.000 --> 00:00:28.100 the previous demo to start our listener with Metasploit. 00:00:32.439 --> 00:00:36.860 Now that our other listener is ready, we can head back to our Windows 10 target. 00:00:38.140 --> 00:00:41.190 Normally, you would copy and paste the text into a Microsoft 00:00:41.200 --> 00:00:43.750 Office file of your choice as a macro. 00:00:44.440 --> 00:00:48.760 Even a free one‑month trial of Office requires a credit card to sign up and 00:00:48.760 --> 00:00:52.320 could charge you if you forget to cancel, so to maximize everyone's 00:00:52.320 --> 00:00:54.960 capability to follow along in this demo risk free, 00:00:55.340 --> 00:00:58.250 I'll adopt this to OpenOffice, which is free. 00:00:59.240 --> 00:01:06.750 Open a new document with OpenOffice, and then go to Tools, 00:01:08.140 --> 00:01:12.560 Macros, Organize Macros, OpenOffice Basic. 00:01:14.640 --> 00:01:18.180 Now we need to create a new macro. For that, under the name of our 00:01:18.180 --> 00:01:23.050 document, we just hit New, we can leave the default name, 00:01:23.120 --> 00:01:25.860 Module1, and that will open the editor. 00:01:27.340 --> 00:01:31.550 Now we just paste in our PowerShell content above the main module. For our 00:01:31.550 --> 00:01:36.760 modifications, all we have to do is delete VBA from the front of CreateObject, 00:01:38.840 --> 00:01:47.900 and then we have to change Application.Quit to stardesktop.terminate. If you 00:01:47.900 --> 00:01:51.780 want, you can change the message text here to change the way the message box 00:01:51.780 --> 00:01:55.480 is displayed and not mention Microsoft Office, but I'm just going to leave it 00:01:55.480 --> 00:01:56.360 default for here. 00:01:57.640 --> 00:02:01.360 This, as written, will execute and not be detected by Defender. 00:02:02.140 --> 00:02:04.820 We will unfortunately run into the same issues as the 00:02:04.820 --> 00:02:07.930 previous example with Windows Defender monitoring runtime 00:02:07.930 --> 00:02:10.940 execution. Without the custom shell code, 00:02:10.970 --> 00:02:12.360 there is one other workaround. 00:02:12.940 --> 00:02:14.750 This will work, but as you will see, 00:02:14.920 --> 00:02:18.260 the convincing phishing attack is on another level because you will 00:02:18.260 --> 00:02:20.560 need to run the application as an administrator. 00:02:21.540 --> 00:02:25.370 We can control Windows Defender using PowerShell, so if we add 00:02:25.370 --> 00:02:27.410 another PowerShell command to our macro, 00:02:27.660 --> 00:02:31.950 we can use the command Set‑MpPreference, and set 00:02:31.950 --> 00:02:34.250 ‑DisableRealtimeMonitoring to true. 00:02:35.040 --> 00:02:40.400 Let's add that before our shell. We can use the same set of variables to 00:02:40.400 --> 00:02:42.950 try to further obscure this from Windows Defender. 00:02:43.690 --> 00:02:46.910 These variables here will enable PowerShell to run and 00:02:46.910 --> 00:02:48.760 leave it obscured like it is above. 00:02:49.440 --> 00:02:55.090 Then we just add our command. Make sure the PowerShell window doesn't appear. 00:02:55.090 --> 00:02:57.760 We also need to add windowStyle to this command. 00:02:59.240 --> 00:03:01.420 Alright, so with this command we'll actually disable Windows 00:03:01.420 --> 00:03:04.360 Defender shortly before running our exploit. 00:03:04.410 --> 00:03:08.940 But we are going to need to give that some time to run, so let's actually create 00:03:08.940 --> 00:03:13.360 a second message box that pops up between when this command takes effect and 00:03:13.360 --> 00:03:17.360 when our exploit actually runs. To do that, we're actually going to take these 00:03:17.360 --> 00:03:23.590 variable declarations down here and move them up. Then we can use these two 00:03:23.590 --> 00:03:25.860 lines to create a second message box. 00:03:28.140 --> 00:03:33.470 We'll go ahead and rename this to msg2, and then we'll change this 00:03:33.470 --> 00:03:35.660 message to just say that there was an error. 00:03:42.140 --> 00:03:44.280 Alright, now that are macro is finished, we'll go ahead and 00:03:44.280 --> 00:03:47.960 save this, and then close the macro editor. 00:03:48.740 --> 00:03:51.560 And next we're going to go ahead and save a copy of this file. 00:03:52.040 --> 00:03:55.170 The reason for saving a copy is that our next step is to make 00:03:55.170 --> 00:03:57.460 this macro execute when the document is opened. 00:03:58.340 --> 00:04:01.490 We want to have a copy so that we have something to edit that when we 00:04:01.490 --> 00:04:05.870 open it won't execute our macro every time. I'm going to call this 00:04:05.870 --> 00:04:10.660 file test2. Now that we've saved a copy, 00:04:10.670 --> 00:04:13.550 let's go ahead and make this macro payload execute when the 00:04:13.550 --> 00:04:19.930 file is opened. To do that, we go to Tools, Customize, go to 00:04:19.930 --> 00:04:23.350 Open Document, and assign our macro. 00:04:29.440 --> 00:04:35.360 And then just click OK, and save it again, and we're all set for our test. 00:04:35.940 --> 00:04:39.370 So we'll go ahead and close this out. Now remember for this next part 00:04:39.370 --> 00:04:48.480 we're going to need to run OpenOffice as administrator, and we open our 00:04:48.480 --> 00:04:57.360 document, test2. And we have our first message, just give that a second, 00:04:59.640 --> 00:05:03.230 and we see that Windows Defender is turned off. And then we have our 00:05:03.230 --> 00:05:07.560 second message, and if we click OK, the document closes. 00:05:09.840 --> 00:05:12.750 And then back on Kali we have our shell. 00:05:14.240 --> 00:05:18.660 So both of our attacks developed with Unicorn succeeded. For a 00:05:18.660 --> 00:05:20.660 quick recap of what we covered in this lesson, 00:05:20.760 --> 00:05:24.930 we executed both of our attacks that we developed earlier in this course. 00:05:24.930 --> 00:05:28.660 We tested out our HTA on the Metasploitable 3 machine, 00:05:29.640 --> 00:05:32.640 and we modified our macro to work with OpenOffice and 00:05:32.640 --> 00:05:35.250 successfully ran it against our Windows 10 host.