Let's get familiar with making a general macro inside of Microsoft Excel. We're
going to use
Excel because it's kind of the same flow through all Microsoft Office
applications.
And I just like messing with spreadsheet sometimes. So we're on the side screen
over here. And the
first thing I want you to do is go to file. There we go. And into our options,
if I can find them
down at the bottom left. And now we're going to go into the customize ribbon.
The reason for this
is we need to add the developers tab in order to be able to go through and
create these macros.
And let me see. I get right there. I'm going to zoom in for you and show you
macros,
View macros. And I'm going to add it to the. I have to add it to one of the
other tabs.
I'll say new tab. Add it over. Yep. There we go. We'll call this one a rename
and call it
macro tab. There we go. And hit Okidoki. You can see up on the top now that I
have a macro tab.
And I'm going to go in there and I can see macros now. And once I click inside
of here,
we have our macros that we can work with. And you can also apply it to either
all open workbooks
or just one in particular. Well, I'm going to leave this to all workbooks.
So sorry, I'm going to call this one a test. And then we're going to create.
Now I have to move this over here a little bit because again, I have multi
screens.
But one thing I want to point out here real quick and pause is that now we're
in very familiar
territory as pen testers and cyber security professionals. As I zoom in here on
the top left,
you'll notice that this opens up in Microsoft Visual Basic VBA. And the reason
that I'm really
stressing on this right now is because now we're into actual programming. You
can pretty much invoke
any kind of function inside of this macro now that you can think of and that
you can code.
So if you're familiar with program programming languages like C or Visual Basic
, this is where,
as a pen tester, you can create macros to be able to go through and do things
like command
ejection from our previous skill. And one thing I want to stress more than
anything else, I'm not
finger wagging except to myself because this happens to me more than anybody
knows that we get so
just focused on some of the pen testing skills and techniques that we know
already. And some of the
usual tactics that we apply to be able to increase our threat vector across the
network that we
kind of forget about some of the basics. And some of the basics include
Microsoft Office.
Microsoft Office as a whole may seem pretty simplistic for us to be able to go
through and
utilize like with Word and Excel and also PowerPoint and many other things. But
the point I'm trying
to make here is that it's okay to go back and refresh your skills on Microsoft
Office and other
beginning programs that we consider basic level because we are able to perform
a lot of exploits
inside of these programs. And I would very much like recommend that you check
out Miss Simone
Stoff here on CBT Nuggets because she is by far the professional, the expert,
the pinnacle of
Microsoft Office understanding. And there are a couple of skills in there that
where she covers
macros and how to implement within side the Microsoft Office world. And you're
understanding
of macros and going through some of those refreshers and whatever other refres
hers we have here on CBT
Nuggets for you allow us to be able to understand and apply that learning to
skills and courses like
pen 200 for us to be able to go in and exploit those suckers. I mean, target
test aid, pen test
aid, legally with permission. Now back inside of our Microsoft Excel macro
editor, I've opened up
test in the VBA we're taking a look at. One thing I want to show you in
particular is as I zoom in,
I have shell notepad exe VB normal focus. This is a very simplistic macro. And
all this is going to
do is open up notepad for us. You might be thinking here for a second, you're
starting to see the
connection between macro exploitation in Microsoft Office and some of the
previous stuff we've done
in those skills. Yep, that's why we have the skill. Now if you look right above
that, you'll see a plus
or a play sign a pause and a stop. This allows us to be able to test out that
macro and some of the
coding that we're doing inside of here to make sure that this is running
correctly and doing exactly
what we want it to do. For example, now I just have that one line with the
shell. If I press play
and I say macro name, I'm going to run test boom, chakalaka, there's notepad.
exe for us. And this
opens up a whole world of opportunity for us to be able to do exploitation
inside of office as we
start to be able to put things in here like that not sled or the fake
calculator or command
ejection that we've done in previous skills and even go so far as to do some
directory and file
traversal inside of office. Now a lot of this comes with understanding the
permission levels
that we're at on the individual system. So there's assumptions that we need to
make here and some
things that we need to rely on basically lessons learned from lessons passed.
For instance, we know
that a lot of users like to log into their personal systems at home using
administrative privileges
because they don't like using passwords. I've been to a lot of my friends
places and whenever
they tell me, hey, do something on the computer for me. There's no password.
There's no username
that they even have to log into. And they still have full permissions on that
system. Now, why does
this really matter for us? Well, during the pentested lifecycle, when we're
doing reconnaissance,
we can understand and know who those big players are at the organization that
we're doing the
pentas for. And if their system is within the scope for our rules of engagement
, that makes it
even better for us to be able to target them. And there may be some systems
that come into play
within that rules of engagement scope that allow us to touch some of those
systems that may not
be configured correctly. This starts to get inside of that BYOD world that
bring your own device.
And this is really going to test if those security administrators and
technicians
are implementing proper protocols for BYOD compliance within the organization.