The Old Switcheroo
When the victim enables our content,
they will expect to see our “decrypted” content, in this case a resume.
We also hope that the victim will keep the document open
long enough for our reverse shell to connect.
The best way to do this, and continue the deception,
is to present relevant and expected content.
Let’s take a moment to focus on developing relevant content,
which varies based on our pretext.
In our case, we are targeting an employee in Human Resources,
so we’ll create an intriguing resume and include other HR-related material.
To begin the development of our “decrypted” content,
we’ll create a copy of this Word document,
and delete the existing text content.
Next, we’ll insert “decrypted” content,
which will display when the user enables macros.
This content will include the simple fake CV.
With the text created, we’ll mark it
and navigate to Insert > Quick Parts
AutoTexts
and Save Selection to AutoText Gallery
In the Create New Building Block dialog box, we’ll enter the name “TheDoc”.
With the content stored, we can delete it from the main text area of the document.
Next, we’ll copy the fake RSA encrypted text from the original Word document
and insert it into the main text area of this document.
Now we’ll need to edit the VBA macro,
inserting commands that will delete the fake RSA encrypted text
and replace it with the fake CV from the AutoText entry.
Luckily, this is pretty simple.
The first step is to delete the fake RSA encrypted text
through the ActiveDocument.Content property.
Then we’ll invoke the Select method
to select the entire range of the ActiveDocument.
With the content of the ActiveDocument selected,
we can call Selection.Delete to delete it.
Now that the text is deleted, we can insert the fake CV.
We’ll reference the AutoText entries from the AttachedTemplate of the ActiveDocument
This gives us access to all of the AutoTextEntries
where we can choose our inserted text named “TheDoc”.
To insert the text into the document we'll invoke the Insert function,
which takes two arguments.
The first sets the location of the insert
and the second sets the formatting in the inserted text,
which we’ll leave as the default RichText.
Let's review what we've done.
we use Document_Open and AutoOpen to guarantee that the macro
will run when the document is opened and the user enables macros.
When the macro runs, the SubstitutePage procedure selects all the text on the page
deletes it,
and inserts our fake CV.
The goal of this is to trick the victim into believing
that they have decrypted our document.
Let’s try this out.
Opening the document will first show the “encrypted” document
and wait for the user to enable macros.
Once they do, the CV is “decrypted” and presented.
Although this scenario may seem far-fetched,
this type of pretext is often successful and we have used it many times
to trick a victim into disabling both Protected View and Macro security.