Okay, we're starting off inside of Kelly because I wanted to show you that
there's nothing up my
sleeves here and my folder for FTP is clear. Now we're going to pop back over
to the Windows 10
system here for a second and I'll go full screen for us. And you can see here
that I have as I zoom
in, doc one and it's also highlighted. So you can see where the type is
Microsoft Word macro-enabled
document. And this is the one that I set up already for the solution here. So
when we open this up,
it should all automatically run and you can see right there where we get our
little message window
of done. Now if I go ahead and minimize this, you can see that the output text
was also created as
well too. Go ahead and open that up and you can see that it's IP config for
this very system.
And now I'm going to go back over to the Kali box and you could see that yep,
it did in fact work
and it sent it through FTP using curl in our macro to send that output to a
different system.
There's the IP config right there. Now we'll take a look at the actual Word
document inside of
Windows or Microsoft Word. Going to the macros and then I'm going to go into
edit,
just pick the first one. And again on the left, you can see that I have this
document highlighted
and this is the macro right here. Again, it's the very same thing that we have
in the code up above
this video, below the challenge video. And you can see that it's a very slimmed
down version and
there were some minor changes made. For instance, we took out all the, we had
to make a change to a
variable name because Microsoft Word edit reserved. And we also made it to
where it was to the document
itself and you can see where it says sub document underscore open, noting that
this happens whenever
the document itself is opened. But other than that, everything else is pretty
much staying the same
as far as the code goes for inside of Excel. Further emphasizing that this is
pretty much a VB script
or C++ field day for developing exploits that go with your common applications.
Now I mentioned above
in little text for the solution that this is exactly why we tell our users
within every
organization we work at to be very cautious about opening email attachments
because Office
isn't the only one susceptible to things like this. It could be Adobe like in
PDFs. It could be
text documents. It could be that we've crafted another program like the
calculator in the previous
couple of skills. So there are many different reasons why you wouldn't want to
open attachments
from folks that you don't know right off the bat. And on top of that, I'm going
to open up the word
of security settings and find where the stuff is for the macros. To do that, we
're going to go to
File Options down on the bottom left and then go to Trust Center which is on
the bottom left side.
And inside of here, you'll see that we will we click on the button to go into
Trust Center Settings
that I have already gone through and said disable all macros with notification.
So we've already trusted the macro that went with this, but running it for the
first time in your
challenge, you would have noticed that up at the top near the ribbon of tools,
you got a yellow
bar across the screen that talked to you about macro security. And this would
normally be on
the bottom option of enable all macros, excuse me, disable all macros without
notification or one
of those two right there depending on your policy. The worst one and a lot of
folks do this is go
into enable enable all macros. And not only is it not recommended, it's
something that as a system
or security administrator, you should give a stern wag of the finger to a user
that does this.
Because again, if they're running as an administrator on a BYOB device,
the device and it's inside the actual organization itself could lead to a lot
of information about
the network for a pen tester to not only conduct further reconnaissance, but
also find an attack
point to pivot from and increase the threat factor. And again, we're going to
keep building
upon these skills and you'll see us refer back to some of these wonderful tid
bits and skills that
we've learned along the way as we continue our trek through 10 200. I hope this
has been
informative for you and I'd like to thank you for viewing.