Let PowerShell Help Us
So far we have focused on Microsoft Office
and discussed the very basic mechanics of VBA macros.
Next, we’ll discuss how we can use the extremely powerful and flexible
PowerShell environment,
together with phishing attacks using Word or Excel documents.
As discussed in the previous section,
VBA is a compiled language that makes use of types.
On the other hand, PowerShell is compiled and executed on the fly
through the .NET framework,
generally does not use types and offers more felxibility.
To declare a variable in PowerShell, we simply use the dollar sign ($) character.
PowerShell control logic, such as branching statements and loops
follow similar syntax as most other scripting languages.
Since PowerShell has access to the .NET framework,
we can easily implement specialized techniques such as download cradles
to download content, like second stage payloads, from external web servers.
The most commonly used variant is the Net.WebClient class.
By instantiating an object from this class, we can call the DownloadFile method
to download any file from a web server to the victim.
In this example, we’ll show how to invoke the DownloadFile method.
We’ll start by assembling a full script and then reduce it to a single one-liner.
DownloadFile takes two arguments:
the URL of the file to be downloaded and the output filename.
First, we created a variable for the file we want to download,
then a variable for the name of the local file.
Next, we instantiated the Net.WebClient class to create a download cradle,
from which we then invoke the DownloadFile method to download the file.
In this case, we used the same staged Meterpreter executable we created earlier.
Alternatively, the four lines can be compressed into a single one-liner.
Let’s embed this into our Word macro using VBA
and have PowerShell do the heavy lifting for us.
We’ll slowly build it here, piece by piece, and then review the completed code.
As an overview, we’ll set up a download cradle
by converting our PowerShell string to work in VBA.
Then we’ll give the system time to download the file
and finally we'll execute the file.
Let’s start writing our VBA code.
The first step is to declare our string variable,
and fill that string with the code of our PowerShell download cradle.
Next, we’ll use the Shell method
to start PowerShell with the one-liner as an argument.
We’ll then instruct the Shell method to run the code
with the output hidden from the user.
This code will download the file to our victim’s machine.
Before executing this code, we start a multi handler listener.
To execute the Meterpreter executable through VBA,
we must specify the full path.
Luckily, downloaded content will end up in the current folder of the Word document,
and we can obtain the path name with the ActiveDocument.Path property.
Since we are downloading the Meterpreter executable from a web server
and the download time may vary, we must introduce a time delay.
Unfortunately Microsoft Word does not have a wait or sleep VBA function like Excel,
so we’ll implement a custom Wait method
using a Do loop and the Now and DateAdd functions.
This will allow us to pass a Wait parameter,
measured in seconds, and pause the execution.
To ensure that our Wait procedure does not block Microsoft Word,
each iteration calls DoEvents to allow processing of other actions.
To begin, we’ll retrieve the current date and time
with the Now function and save it to the t variable.
Then we’ll use a Do loop,
which will work through the comparision declared in the Loop Until statement.
This code will continue to loop until the comparison is true,
which happens when the current time, returned by Now,
is greater than the time returned by the DateAdd function.
This function takes three arguments:
“s” is a string expression that represents the interval of time,
n is the number of seconds to wait,
and t is the current time.
Simply stated, “n” seconds are added to the time the loops starts
and the result is compared to the current time.
Once “n” seconds have passed, the loop completes.
With the Wait method in place we just need to invoke it
and then execute the Meterpreter executable.
To do that, we’ll again use the Shell function and call the exePath we created.
Finally, we execute the macro,
and catch our meterpreter shell.
Let’s review what we did.
We built a Word document that pulls the Meterpreter executable
from our web server when the document is opened.
We added a small time delay to allow the file to completely download.
We then executed the file hidden from the user.
This results in a reverse Meterpreter shell.