OK, let's have another example in the Empire project.
This time, we're going to create a macro to prepare malicious office document at this point, we already
have a listener.
So I jumped to the stage your generation step.
Type used stager put a space character and press tab twice to see all of the available stagers, and
we use Windows Macro to create a macro which will open a back door into the victim's machine type used
stager windows macro and hit enter.
Type info to see the options, we have to set the listener now type set listener, my HTP listener,
or if you gave it another name to the listener, type it leave the other options with the default values.
Run, execute, command to generate the macro, the macro is generated in the tent folder, TMP folder
with the name of Macro.
Let's go to the tent folder and look at the file using Cat Linux Command.
Selective copy the macro code.
Now it's time to create the malicious office file using this macro code, we're now in a Windows system.
I'm going to create a word document.
Open a new document from The View tab, open macro window.
Paste the macro code that we copied in Cali, save and close the macro window, the macro code is not
in the clipboard of your victim windows machine.
I mean, if you cannot paste the macro code in Windows system, copy paste action may not be allowed
by your virtualization platform, VMware Virtual Box, etc..
Don't worry, there are lots of ways to bring the macro code in.
For example, it may change the configuration of your virtualization environment to allow copy paste
between the virtual machines.
Another method is sending the code to yourself in an email so you can open the email and the victim's
machine and copy the macro code.
Now, of course, to be able to see the effects of our code, the macro has to be enabled in the victim's
office tool.
Now I'm using my office 2013 to enable macros.
I follow the path file options, trust center, trust centre settings and click enable all macros,
then the OK button.
Save the word document on the desktop and close now the document has the macro code inside and the macros
are enabled in the office tool.
I want to touch on two topics here.
First, as you can see on the right hand corner of the screen, I'm going to open the malicious document
while Windows Defender is running.
So we'll see if we can bypass the security systems or not.
Second, of course, we don't expect the victim to prepare the file himself.
We are testing the document that we prepared, sending it to victims and convincing them to open the
files as another case.
Now, open a word document, it seems everything's fine.
Something abnormal doesn't appear.
Let's go to our Calli system, as you see, we have a new agent initialised.
Go to the main menu using main command.
There was one agent at the beginning.
Now we have two of them.
Go to Agent State using agents command, the second one is our new session, which started when the
victim opened the word document.
Use Interac command with the agent named Activate the Session.
Now the victim machine is in your hands.