Welcome to Execution with macro_pack course.
In here,
you'll learn how to hide malicious executable files into Microsoft Office
files. In this course, we'll talk a lot about masquerading,
and the idea of masquerading is hiding malicious files into a
legitimate file, so then your victim will not suspect about it and
will open the file, and this idea of masquerading is really important
in the red team engagement. For example,
imagine that you work in a financial company, then one day you
receive an email that looks like from one of your directors,
and the email says something like, hey,
can you take a quick look at the attached report?
Most people would look at the attachment file and not suspect anything,
since it's just an Excel spreadsheet.
A lot of people think that malware is only in executable files,
but they forget that Office files can also contain malware. So
then, you go and open the Excel spreadsheet, and from what you
see the spreadsheet looks normal,
but in reality the hacker was able to get a shell to your computer,
and now the attacker has full control of your laptop.
What is happening on the background is that the Excel
spreadsheet had a macro script in it.
If you're not familiar with macros,
basically they are a piece of software written in Visual Basic that can
be hidden in a Microsoft Office application such as Word or Excel, and
then when someone opened the Excel file, the Visual Basic script is
executed without you knowing about it.
In theory, you can write your own malicious payload in Visual Basic
and then manually include that in any Office file.
However, there is a smarter way of doing that,
which is using the macro_pack tool.
This tool allows you to hide malicious payloads into Microsoft Office files,
and the best part is you don't even need to know how to code in Visual Basic.
The macro_pack tool was developed by Emeric Nasi, which
is a famous cyber security researcher.
And thanks to him,
I can save a lot of time when I need to masquerade some
malicious payloads, so thanks Emeric. Also, check out his
Twitter and his other work. He has some really good publications
on how to bypass detection systems.
The macro_pack is a tool to automate obfuscation and
generation of Office documents,
Visual Basic scripts, shortcuts, and other formats. As you see in
this course, we can do a lot with this tool.
What I like about macro_pack is that it's an open source tool, meaning
that you can download it and customize it if you want. You can find the
tool at this GitHub page. As I mentioned, this tool is focused on
automating the incorporation of malicious code into Microsoft Office
files, or in other words,
this is a tool that will help us to masquerade malicious files.
And this tool will help us to exploit the easiest point of entering a company,
which is people. Knowing how to craft a convincing phishing email
is a really important skill for a red teamer,
and with macro_pack, you increase your chance of success in a phishing attempt.
If you're familiar with the red team kill chain, we can make the
macro_pack tool to both exploit and privilege escalation.
For example,
we can use masqueraded malicious files to phish an
HR person to get their account, and after getting access to their account,
we can try to send malicious files to admins, so then
we can escalate their privileges.
Also,
if you're familiar with the MITRE ATT&CK framework, we can map this
course to two main errors, initial access and execution. Instead of
execution, we'll cover user execution, and more specific, this
subcategory, malicious files,
which means we'll get access to the systems by making our victim execute a
malicious file that we will be sending to them. The second technique that
we'll cover is command and scripting interpreter languages, and more
specific, we'll cover the Visual Basic language.
And this means that our payload will be generating Visual Basic, and this
malicious code will be masqueraded into a legitimate file. Inside of
initial access, we cover the phishing technique, or more specific, the
spearphishing attachment. Basically,
we'll take the malicious files that we created and send to
our victim via attachment in an email.
But before getting to the technical part to this course,
I want you to keep in mind that performing any of those attacks without
authorization is illegal in most of the countries, and this means if you
send malware to someone to try to hack them,
you may go to jail,
especially if entering their computer or their account.
It's definitely a criminal offense.
Also,
you should be really careful when performing any attack that
impact the customer environment, for example,
our malicious payload in the Office file may affect the laptop of our
victim, and I'm sure that the CEO would not be happy if his computer
goes down because of a security test.
So make sure the client is okay with you performing such attacks,
and make sure you have everything formalized.
Also, it is really important to stay legal, so first,
if you're working a red team project,
make sure you have a letter of engagement from the client
detailing the dates that the test will be executed, as well
as the types of attacking scope.
And also it is important to have a formal document signed by the client,
detailing and authorizing the attacks that you'll be performing.
And this document is what differentiates a criminal from a professional red team
specialist. And, as a personal recommendation, always consult the client before
executing any attack that may impact the network.
So, bottom line, don't be a criminal.
So let's take a minute to understand the attack that we'll be
performing here. First, imagine you're working a red team engagement
and you have to compromise a financial institution.
So then we will create a legitimate Excel file that
looks like a real spreadsheet.
Then we also create a malicious payload that we want our victim to execute.
In my case,
I will use a reverse shell payload, and this means that
when the victim executes the file,
the malicious script will connect back to my attacking machine and
give me shell access to the victim computer.
So, okay, we have a legit file and a malicious payload.
Then, the next step is to use the macro_pack tool to combine both
files into one file, and this means that the final file will look
exactly like an Excel spreadsheet, but when the user opens it, my
payload will be executed.
Once we have our masqueraded file,
we'll put it into a convincing phishing email and then we'll send it to our
victim. Once the victim opens the file and execute the macros in the document,
we'll get a reverse shell in our attacking machine, and this means that we'll
have full access to the victim computer.
That's pretty cool, right?
Even though this might seem a simple attack,
you'd be surprised on how this works in a lot of cases,
especially if a victim is a known IT person the chance of
them opening this file is really high.
So if you want to get the most out of this course, I do recommend
you having a small lab environment so you can practice those
attacks. In here, I'll be using two machines.
One is our attacker machine,
which can be a Windows 10 or a Kali Linux machine, and
the other one is our target machine, which is our victim computer.
In this case, they should be running Windows or Windows Server.
Also, as we are working with Microsoft Office files,
both attacker and victim machines should have Microsoft Office installed.
So, okay,
enough of talking, let's go to our lab and see how
this attack is done in real life.