‫Just like embedding a malicious code into a PDF file, you can easily embed a malicious macro code into
‫an EMS office document such as an s word.
‫To create a malicious word document, we should prepare a macro code and the payload, which is used
‫by the macro.
‫Let's prepare a malicious word document using the Métis Floyd framework and Vayle framework, the steps
‫of this example will be.
‫Creating a malicious executable, converting the malware into a macro code which is ready to be embedded
‫into an office document.
‫Creating the office document.
‫Embedding the script code is a macro and concatenating the payload as text, starting a listener to
‫listen to the sessions of the victims who opened the office document.
‫Opening the document is a victim.
‫Collecting the session as the attacker now let's do it first, create a malicious executable using Vayle,
‫I'll take it faster now because we've already done this before to remember, please refer to our creating
‫custom payloads with Vayle Lecture Choose List in the main menu type.
‫Use one to use evasion tool type list a list available payloads.
‫Let's use payload twenty seven.
‫Setting the listener host is enough at the minimum.
‫And generate give the name initials for the outpost files.
‫Choose the executable creation method.
‫OK, malicious, executable is created.
‫Let's test our malware to see if it's working, transfer the file to the victim machine.
‫Now here I have a Windows eight system as victim.
‫I'm going to use the win SICP trial to transfer the file.
‫And of course, we have to find a reasonable way to do it.
‫Phishing, malicious website visit, et cetera.
‫Copy the malware into the S.H. User Home folder for ease of use.
‫Run win SICP.
‫Connected to the Kawi machine.
‫And transfer the file to the Windows desktop.
‫Start a handler to collect the session, go to Caleigh and start the MSF console with the Dasha parameter
‫and use the RC file produced by Vayle.
‫Handlers started is at the background.
‫With the session dash l command, we see that no session is in progress at the moment, run the malicious
‫executable in the Windows system.
‫We now have a valid session of the Windows system.
‫Use the sessions dashi session ID command to interact with the session.
‫Our malware is working like a charm.
‫Now, let's kill the session for now, because this was just a test of the malware is working well.
‫Sessions dash kay uppercase Kay will kill all the open sessions.
‫Now we'll create a visual basic script using our malicious executable file.
‫We're in the Calli machine, so find the location of the exact two VBA script using Locate Command in
‫Linux.
‫Go to the folder.
‫And Ron Exacta Vrba Ruby script, the script needs to parameters to run.
‫First, the malicious executable with full path, which will be converted to a macro code.
‫Second, the name of the output file.
‫The script is created, now is the time to create the malware embedded word document, go to the Windows
‫machine, which is the system of the victim, and transfer the micro file using wind SICP.
‫Let's open the Vrba file using a notepad, I'm using notepad plus plus for this purpose because the
‫dot VBA file is a bit big and notepad plus plus has a much better memory management than the native
‫notepad application in Windows.
‫There are two parts in the dark Vrba file, the first part is the macro code.
‫Second part is the payload that will be used by the macro to create the metro intersession.
‫Now, start using MS word and create a new word document, by the way, do you wonder why I use Windows
‫eight, an office 2013?
‫Because I have their licenses and no others.
‫Create a macro under view, tab, select macro's, view macros, give a name and click the create button.
‫I'm using the word application of office 2013, if you use a different version, your menus might differ.
‫Please Google it to find the location.
‫Open our doors, Vrba file and copy the macro code part and paste it into macro code page.
‫Save the changes and close the page.
‫And we have malicious macro codes inside the document.
‫Now, we still have to embed the payload into the document.
‫Go to the Dot Vrba file, copy payload data part.
‫And pasted into the word document, we have quite a big payload, and I confess it's bigger than I expected.
‫This is because we used Vail to create a custom malware and we chose interpretor, which is a complex
‫one.
‫Wait until the paste is finished.
‫It could take 15 to 20 seconds.
‫To make the documents seem like a regular document.
‫You can shrink the font size, for example, make it one.
‫And you can make the font color of the payload white.
‫Then save the file.
‫To succeed in this attack, word application has to be configured to run macro codes.
‫In MS word, all macros are disabled by default, so you have to convince the victim to enable the macros
‫as well.
‫In file menu, select options.
‫Select Trust Center, Click Trust Center settings, button and tick enable all macro's option, click
‫OK at the lower right corner.
‫Now we have a macro enabled MS word.
‫Be sure the handler is running at the moment.
‫Opened the word document we created, it may take some time because the document is a big one.
‫Wait a few seconds.
‫You have a new session for the victims system.
‫Congratulations.