‫OK, let's have another example in the NPR project.
‫This time, we're going to create a macro to prepare malicious office document at this point, we already
‫have a listener.
‫So I jumped to the stage your generation step.
‫Type used stager put a space character and press tab twice to see all of the available stagers, and
‫we use Windows Macro to create a macro which will open a back door into the victim's machine type used
‫stager windows macro and hit enter.
‫Type info to see the options, we have to set the listener now type set listener, my HTP listener,
‫or if you gave it another name to the listener, type it leave the other options with the default values.
‫Run, execute, command to generate the macro, the macro is generated in the tent folder, TMP folder
‫with the name of Macro.
‫Let's go to the tent folder and look at the file using Cat Linux Command.
‫Selective copy the macro code.
‫Now it's time to create the malicious office file using this macro code, we're now at a Windows system.
‫I'm going to create a word document.
‫Open a new document from The View tab, open macro window.
‫Paste the macro code that we copied in Cali, save and close the macro window, the macro code is not
‫in the clipboard of your victim windows machine.
‫I mean, if you cannot paste the macro code and Windows system, copy paste action may not be allowed
‫by your virtualization platform, VMware Virtual Box, etc..
‫Don't worry, there are lots of ways to bring the macro code in.
‫For example, it may change the configuration of your virtualization environment to allow copy paste
‫between the virtual machines.
‫Another method is sending the code to yourself in an email so you can open the email in the victim's
‫machine and copy the macro code.
‫Now, of course, to be able to see the effects of our code, the macro has to be enabled in the victim's
‫office tool.
‫I'm using my office 2013 to enable macros.
‫I follow the path file options trust center, trust centre settings.
‫And click, enable all macros, then the OK button.
‫Save the word document on the desktop and close now the document has the macro code inside and the macros
‫are enabled in the office tool.
‫I want to touch on two topics here.
‫First, as you can see on the right hand corner of the screen, I'm going to open the militias document
‫while Windows Defender is running.
‫So we'll see if we can bypass the security systems or not.
‫Second, of course, we don't expect the victim to prepare the file himself.
‫We are testing the document that we prepared, sending it to victims and convincing them to open the
‫files as another case.
‫Now, open a word document seems everything's fine.
‫Something abnormal doesn't appear.
‫Let's go to our call system, as you see, we have a new agent initialised.
‫Go to the main menu using main command.
‫There was one agent at the beginning.
‫Now we have two of them.
‫Go to Agent State using agents command, the second one is our new session, which started when the
‫victim opened the word document.
‫Use Interac command with the agent named Activate the Session.
‫Now the victim machine is in your hands.