+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: {TUTORIAL} Convert Exe Files Into Office Word Macro Exploits (/showthread.php?tid=4508986)
{TUTORIAL} Convert Exe Files Into Office Word Macro Exploits - Demoralise - Oct 26, 2014
In this tutorial we will need these things:
Computer with Office Word
Kali Linux in VM with Metasploit
Internet Access
Your RAT server
WordPad (optional)
That is all you need :)
Steps:
1: Open Kali and scroll to this directory via Terminal. Use ls to make sure that exe2vba.rb exists:
[img]http://gfxf.net/images/2014/10/26/2a76a5.png[/img]
2: Then upload your RAT to http://ge.tt on the PC outside the VM:
[img]http://gfxf.net/images/2014/10/26/Tofix.png[/img]
3: After that, download the exe to the same directory:
[img]http://gfxf.net/images/2014/10/26/41e064.png[/img]
4: Then run this command to create a vba script:
[img]http://gfxf.net/images/2014/10/26/5.png[/img]
5: Followed by uploading the VBA to http://ge.tt , downloading it on the computer outside VM and opening the file. You want to delete all the code from the top up until the end of the PAYLOAD DATA comment:
[img]http://gfxf.net/images/2014/10/26/7.png[/img]
6: By using Ctrl + A, select the rest of the text and using Ctrl + C to copy the info then Ctrl + V to paste, paste it into Word then set the colour to white:
[img]http://gfxf.net/images/2014/10/26/8.png[/img]
7: Now go back to the vba, press Ctrl + Z, then Ctrl + C to copy the data. Or you could use right click - copy:
[img]http://gfxf.net/images/2014/10/26/Tofix2.png[/img]
8: Now to create the macro. Take the data and do this:
[img]http://gfxf.net/images/2014/10/26/9.png[/img]
9: This should open up. Click Ctrl + A then delete to erase all the info in the box and then click Ctrl + V to enter the coding from the VBA:
[img]http://gfxf.net/images/2014/10/26/11.png[/img]
10: Then hit Ctrl + S, and save the file as a .docm file:
[img]http://gfxf.net/images/2014/10/26/12.png[/img]
The exploit is done. Now if you send it to a victim which has their Office Word security setting set to "Disable macros with warning" and they open the file, they will get a security warning. If they allow it the file executes.
Hope you enjoy the method :)
You may have noticed my negative rep. I got repfucked recently for creating a deal dispute as a community alert by accident, a simple thread creation mistake. Omni did not like me creating a community alert to draw attention to a scam and cause unnecessary flaming so I got a repfuck. Guess I'll have to regain my rep.
Don't hesitate to post or ask questions :)
- Demoralise
* - Water Aura - Oct 26, 2014
Atleast this stops the sale of the shitty Office Word Macro Exploits which is being sold for like 200$+.
* - Gr0wn - Oct 26, 2014
One tip OP, change the upload url. Get.t distributes their files for analysis just like virus total and dropbox. Otherwise, thanks!
* - dogfuker - Oct 26, 2014
(Oct 26, 2014 11:38 PM)Gr0wn Wrote: One tip OP, change the upload url. Get.t distributes their files for analysis just like virus total and dropbox. Otherwise, thanks!
One tip, don't fucking quote the OP....
* - Gr0wn - Oct 26, 2014
(Oct 26, 2014 11:42 PM)Derby Wrote: One tip, don't fucking quote the OP....
What? that was a misclick hence me editing it before your response.
* - OMGNEEDSLEEP - Oct 27, 2014
Well done, this is a pretty good tutorial and now people do not need to buy exploits.
* - Stephano™ - Oct 27, 2014
Knowing this goes for around 200$ on the marketplace, and seeing how easy it is make me laugh 🤣
* - chuma_chums - Oct 27, 2014
is this all for free? it still a little too complicated for me, but instead of spending a fortune on the program to teach us. thank you man. so can anyone set it up for me using the team viewer. i will be most grateful cause i have a .exe file that i really need to convert to .doc so gmail wouldnt be able to detect it. thanks
* - Demoralise - Oct 27, 2014
(Oct 27, 2014 11:11 PM)chuma_chums Wrote: is this all for free? it still a little too complicated for me, but instead of spending a fortune on the program to teach us. thank you man. so can anyone set it up for me using the team viewer. i will be most grateful cause i have a .exe file that i really need to convert to .doc so gmail wouldnt be able to detect it. thanksThe method is old so it may be detected, Gmail still scans .docm files.
* - 420 Blaze It - Oct 27, 2014
Nice, you saved lots of people some cash buying these exploits.
* - GenasisX86 - Oct 29, 2014
Excellent share thanks Demoralise. Cant believe some of the haters here. lol.
* - Demoralise - Oct 29, 2014
(Oct 29, 2014 03:14 AM)GenasisX Wrote: Excellent share thanks Demoralise. Cant believe some of the haters here. lol.Thanks :) I really appreciate the feedback 🤝
* - Ɛxɛcutivɛ - Nov 1, 2014
what macro setting is word on by default? do i have to use social engineering in order to make them change it?
* - Jokeh - Nov 1, 2014
(Oct 26, 2014 08:53 PM)Water Aura Wrote: Atleast this stops the sale of the shitty Office Word Macro Exploits which is being sold for like 200$+.
I think you're refering to trickydb ;)
* - umberto94 - Nov 1, 2014
Excellent share thanks Demoralise. :)