Introduction to VBA
In this section, we’ll discuss the basics of VBA,
along with the embedded security mechanisms of Microsoft Office.
We’ll begin by creating our first macro,
which will include a few conditional statements and message boxes.
Then we’ll try to run a command prompt from MS Word,
with the help of Windows Script Host.
To begin our development, we’ll open Microsoft Word
on the Windows 10 victim machine,
and create a new document.
We can access the Macro menu by navigating to the View tab,
and selecting Macros.
From the Macros dialog window, we must choose
the current document from the drop down menu.
For an unnamed document this is called “Document1”.
After selecting the current document, we’ll enter a name for the macro.
In this example, we’ll name the macro “MyMacro”
and select, Create.
This will launch the VBA editor
where we can run and debug the code.
When we create a macro, the editor automatically
creates a small starting code segment.
The important keyword in the small code segment is Sub MyMacro,
which defines the beginning of a method called “MyMacro”
while End Sub ends the method.
Variables are very useful when programming and like other programming languages,
VBA requires that they be declared before use.
This is done through the Dim keyword
with two other parameters; the name of the variable
and its datatype.
In this example, we have three very common data types:
String, which directly translates to a unicode string
Long, which translates to a 64-bit integer
and LongPtr translates to a memory pointer.
They represent the operating system’s native data types
and are commonly used in languages such as C or C++.
Now that we know how to declare variables,
we can use and manipulate them with flow statements.
These include the If and Else statements and the For loop.
Let’s explore these in more detail.
The If and Else statements are complimented by,
the Then and End If keywords to generate a complete branching statement.
When an If condition is met,
the Then condition is executed,
otherwise the Else condition is executed.
Once all conditions are evaulated, the End If exits the branching condition.
In this example, we’ll have our macro check the value of a variable
and based on the result,
display the appropriate built-in MsgBox function.
To execute the macro we either click the “Run Macro” button or press F5.
This macro will display a “True” message box
since the myLong variable is less than five.
Next, we’ll explore the For loop,
which increments a counter through the Next keyword.
The For loop will read the counter three times
and each time it reaches the Next keyword,
it will increment the value of counter by one.
The execution of this macro will present three “Alert” message boxes.
Now that we have briefly discussed custom methods and statements,
we’ll switch our attention to our ultimate goal:
making the victim execute our custom macro.
Since our victim will likely not do this willingly,
we’ll need to leverage existing methods like Document_Open() and AutoOpen(),
both of which will execute when the Word document is opened.
In order for this to work, we must save our document in a Macro-Enabled format
such as .doc or .docm.
The newer .docx will not store macros.
To test out this functionality, we’ll use a very simple macro.
This example uses both Document_Open and AutoOpen for redundancy.
We’ll save the document in the legacy .doc format,
also called Word 97-2003 Document,
and close it.
Now that the document is saved, we can try opening it again.
However, we are presented with a security warning banner
instead of our message box output.
If we press the Enable Content button,
the macro will execute and the message box will appear.
This is the default security setting of any Office application.
This means that when we launch this client-side attack,
we must somehow persuade the victim to both open the document
and enable the macro.
We can inspect these security settings by navigating to File,
Options
Trust Center
and opening TrustCenter Settings:
Within Trust Center, the default security setting
is to “Disable all macros with notification”.
The Protected View options describe a sandbox feature
introduced in Microsoft Office 2010
that is enabled when documents originate from the Internet.
When Protected View is enabled, macros are disabled,
external images are blocked, and the user is presented with an additional warning.
This complicates our situation
since our client-side attack must trick the user
into also turning off Protected View when the document is opened.
We’ll address this shortly.
To wrap up this section, we’ll demonstrate how to use VBA
to launch an external application like cmd.exe.
This will serve as a foundation for other techniques
we’ll use in the rest of the course.
The first and simplest technique leverages the VBA Shell function,
which takes two arguments.
The first is the path and name of the application to launch
along with any arguments to that application.
The second is the WindowStyle, which sets the program’s window style.
As attackers, the vbHide value or its numerical equivalent of 0
is the most interesting as it will hide the window of the program launched.
In this example, as soon as the victim enables macros,
we’ll launch a command prompt with a hidden window.
Saving the macro
and reopening the Word document
will run the macro without any security warnings,
because we already enabled the macros on this document.
If we rename the document, the security warning will reappear.
Since the command prompt was opened as a hidden window,
it is not displayed, but we can verify that it's running.
We can use Process Explorer from SysInternals to list information
about running processes and which handles and DLLs they have opened or loaded.
In our case, running it will list cmd.exe as a child process of WINWORD.EXE.
We can also use Windows Script Host to launch a shell.
To do this, we’ll invoke the CreateObject method to create a WSH shell,
and from there we can call the Run method.
While this might sound complicated, it is relatively simple.
The call to CreateObject
returns the WSH object,
from which we invoke the Run method, supplying the path
and name of the application to execute,
along with the vbHide window style.
Executing the Macro will once again open cmd.exe as a hidden process.
In this section we learned the basics of VBA and Microsoft Office macros.
We discussed the If statement and For loops and briefly
discussed how we can use VBA to execute other applications.
In the next section,
we’ll build upon this to learn how to execute Meterpreter shellcode.