We're continuing the track of being able to access files and run them from our
macros inside of Microsoft Office programs.
Still sticking with the Excel scheme.
Here on the screen, you can see that I have a folder set up with a couple of
files in it.
And let me zoom in for you.
These may or may not look familiar in the command and injection skill
previously.
I just changed the name of these, by the way.
These are actual sit the AC document with code to open up a reverse shell for
MSF console.
I made these with MSF venom, which again is in the command injection skill
previous to this.
The pad to.exe file is the one that's going to allow us to be able to reverse
shell to our Kali system that I have up and running.
Now this is on the desktop inside of a share folder.
And if we go back to our Excel macro editor, you can see that really the only
thing that we need to do here.
Is really just adjust what this runs in the background.
So for instance, I can delete all of this where it came through and did the IP.
Config to the word document. What I'll do is I'll comment that out.
I'll put a single quotation mark. Is that what it's called?
And notice it turns green, which makes a comment.
And I'm leaving it there simply just because I want to be able to use it again
later.
And when I comment all those out, I'm just going to go up and copy the first
line from our sub attest and add it right below result.
And instead of notepad.exe.
I'm going to be running C drive windows.
Desktop.
Slash Eric.
Slash share.
Slash pad to.exe.
And that's the complete file location of that file that we made inside of MSF
venom.
And we're going to be using our macro here to run it as a back door channel to
our MSF console and Kali.
So I'm going to go ahead and hit the button.
Might help if I had the right file path in there.
I had to change that from C drive window to C drive users.
I'm going to close this stop the macro right there.
And then I'm going to go back to Excel and now hit clear my total so that way I
can still verify the total works.
Go ahead and hit my button and you'll see that this black window pops up.
Now I can hide this, but I left this open on purpose to let me know that it's
actually running.
And I'm going to pop out and go to my Kali box for a second.
I've been my pseudo password of Kali and you can see here my MSF venom just
loaded right when we came in.
And MSF console and right here is where I'm able to access the reverse shell or
command prompt of the actual system.
I simply have an a macro inside of itself.
Now yes, we are command injecting and we are using crafted files that we
created.
But we've already proven that we can get information from the system and send
it to a Word document.
Here later in the skill I want to show you that we can actually transport that
data without using things like MSF console or Metasploit as a whole.
But here and it timed out because I will just let it go.
I'm going to close that, run the button again, come back over to the same Kali
box.
There we go.
It'll come up here in just a second.
And there we go. So now I'm going to do a DIR real quick.
And I know this is a little bit slow responsive, but you can see there as I
zoom in for you that we have our desktop listing of the directory itself.
So we are in that system already and we all we did was just use the file that
we created to do that backdoor channel with MSF venom and use a macro within
Excel to.
Open that file up and open up that channel to our MSF console here on the Kali
box.
One thing that I really want to point out so thus far is if we go back to our
Excel here, not one single error has come up and I have not turned off any of
the security settings for macros or anything related to that inside of the
actual office suite itself.
And you can very well take this inside of the rest of the office suite programs
to do the very same thing that we're doing here.