Executing Shellcode in Word Memory
Now that we have a convincing document,
let’s improve our technical tradecraft to avoid downloading an executable.
Currently, our malicious macro downloads a
Meterpreter executable to the hard drive and executes it.
There are a couple of drawbacks to this.
First, it may be flagged by network monitoring software
or host-based network monitoring.
Second, we are storing the executable on the hard drive,
where it may be detected by antivirus software.
In this section, we’ll modify our attack
and execute the staged Meterpreter payload directly in memory.
This will be a slow process, but we’ll learn valuable techniques along the way.
This concept exceeds the limits of VBA, so instead of using pure VBA,
we’ll leverage native Windows operating system APIs within VBA.