Oct 26, 2014 05:38 PM
(This post was last modified: Oct 26, 2014 06:13 PM by Demoralise.)
In this tutorial we will need these things:
Computer with Office Word
Kali Linux in VM with Metasploit
Internet Access
Your RAT server
WordPad (optional)
That is all you need :)
Steps:
1: Open Kali and scroll to this directory via Terminal. Use ls to make sure that exe2vba.rb exists:
[img]http://gfxf.net/images/2014/10/26/2a76a5.png[/img]
2: Then upload your RAT to http://ge.tt on the PC outside the VM:
[img]http://gfxf.net/images/2014/10/26/Tofix.png[/img]
3: After that, download the exe to the same directory:
[img]http://gfxf.net/images/2014/10/26/41e064.png[/img]
4: Then run this command to create a vba script:
[img]http://gfxf.net/images/2014/10/26/5.png[/img]
5: Followed by uploading the VBA to http://ge.tt , downloading it on the computer outside VM and opening the file. You want to delete all the code from the top up until the end of the PAYLOAD DATA comment:
[img]http://gfxf.net/images/2014/10/26/7.png[/img]
6: By using Ctrl + A, select the rest of the text and using Ctrl + C to copy the info then Ctrl + V to paste, paste it into Word then set the colour to white:
[img]http://gfxf.net/images/2014/10/26/8.png[/img]
7: Now go back to the vba, press Ctrl + Z, then Ctrl + C to copy the data. Or you could use right click - copy:
[img]http://gfxf.net/images/2014/10/26/Tofix2.png[/img]
8: Now to create the macro. Take the data and do this:
[img]http://gfxf.net/images/2014/10/26/9.png[/img]
9: This should open up. Click Ctrl + A then delete to erase all the info in the box and then click Ctrl + V to enter the coding from the VBA:
[img]http://gfxf.net/images/2014/10/26/11.png[/img]
10: Then hit Ctrl + S, and save the file as a .docm file:
[img]http://gfxf.net/images/2014/10/26/12.png[/img]
The exploit is done. Now if you send it to a victim which has their Office Word security setting set to "Disable macros with warning" and they open the file, they will get a security warning. If they allow it the file executes.
Hope you enjoy the method :)
You may have noticed my negative rep. I got repfucked recently for creating a deal dispute as a community alert by accident, a simple thread creation mistake. Omni did not like me creating a community alert to draw attention to a scam and cause unnecessary flaming so I got a repfuck. Guess I'll have to regain my rep.
Don't hesitate to post or ask questions :)
- Demoralise
Computer with Office Word
Kali Linux in VM with Metasploit
Internet Access
Your RAT server
WordPad (optional)
That is all you need :)
Steps:
1: Open Kali and scroll to this directory via Terminal. Use ls to make sure that exe2vba.rb exists:
[img]http://gfxf.net/images/2014/10/26/2a76a5.png[/img]
2: Then upload your RAT to http://ge.tt on the PC outside the VM:
[img]http://gfxf.net/images/2014/10/26/Tofix.png[/img]
3: After that, download the exe to the same directory:
[img]http://gfxf.net/images/2014/10/26/41e064.png[/img]
4: Then run this command to create a vba script:
[img]http://gfxf.net/images/2014/10/26/5.png[/img]
5: Followed by uploading the VBA to http://ge.tt , downloading it on the computer outside VM and opening the file. You want to delete all the code from the top up until the end of the PAYLOAD DATA comment:
[img]http://gfxf.net/images/2014/10/26/7.png[/img]
6: By using Ctrl + A, select the rest of the text and using Ctrl + C to copy the info then Ctrl + V to paste, paste it into Word then set the colour to white:
[img]http://gfxf.net/images/2014/10/26/8.png[/img]
7: Now go back to the vba, press Ctrl + Z, then Ctrl + C to copy the data. Or you could use right click - copy:
[img]http://gfxf.net/images/2014/10/26/Tofix2.png[/img]
8: Now to create the macro. Take the data and do this:
[img]http://gfxf.net/images/2014/10/26/9.png[/img]
9: This should open up. Click Ctrl + A then delete to erase all the info in the box and then click Ctrl + V to enter the coding from the VBA:
[img]http://gfxf.net/images/2014/10/26/11.png[/img]
10: Then hit Ctrl + S, and save the file as a .docm file:
[img]http://gfxf.net/images/2014/10/26/12.png[/img]
The exploit is done. Now if you send it to a victim which has their Office Word security setting set to "Disable macros with warning" and they open the file, they will get a security warning. If they allow it the file executes.
Hope you enjoy the method :)
You may have noticed my negative rep. I got repfucked recently for creating a deal dispute as a community alert by accident, a simple thread creation mistake. Omni did not like me creating a community alert to draw attention to a scam and cause unnecessary flaming so I got a repfuck. Guess I'll have to regain my rep.
Don't hesitate to post or ask questions :)
- Demoralise
![[Image: eBxEg.gif]](https://i.imgur.com/eBxEg.gif)
