Can anyone here help with how to use an existing CVE combined with VBA code/Macros to build malicious .DOC document? Would also need to know how to obfuscate code so it’s not detected
.DOC exploit building |
You can find all of it online. Creating a .docm backdoor is easy, making it FUD is the tricky part. If you only want .doc you will need an exploit. If there is no public code on exploit-db or the like, you will have to exploit it on your own, which is pretty hard.
All my answers/posts are for educational purposes only. I am not in any way responsible for the actions you perform with the acquired knowledge. ![[Image: ZjBA6fR.gif]](https://i.imgur.com/ZjBA6fR.gif)  (Feb 18, 2021 08:22 AM)guardian Wrote: You can find all of it online. Creating a .docm backdoor is easy, making it FUD is the tricky part. If you only want .doc you will need an exploit. If there is no public code on exploit-db or the like, you will have to exploit it on your own, which is pretty hard. Do you by any chance know how to make it FUD?  (Feb 22, 2021 11:45 AM)zelus Wrote: Do you by any chance know how to make it FUD? Google 'VBA Purging' and first page will show an article from a well known red team/ programmer with a tool on GitHub called 'OfficePurge'. The old red team method was VBA stomping but many threat actors hv moved onto purging so this tool simulates the same attack so that companies can test it and defend themselves/update yara rules. Many other blog posts there as well that will help you write / understand VBA, shell code , etc. (Feb 18, 2021 08:22 AM)guardian Wrote: You can find all of it online. Creating a .docm backdoor is easy, making it FUD is the tricky part. If you only want .doc you will need an exploit. If there is no public code on exploit-db or the like, you will have to exploit it on your own, which is pretty hard. Hey thanks a lot for the very helpful reply and Instructions. Much appreciated. So you’re saying to use the .docm format and use that Threat Actors page + VBA purging to make the .docm backdoor FUD? 
A private exe-to-doc exploit worth $2,100 was leaked back in December 2020. It's patched now, but you can still target outdated versions of MS word.
Link: https://github.com/bdunlap9/.Exe-to-.Doc-Exploit Enjoy ✌ 
Mar 3, 2021 07:30 PM
(This post was last modified: Mar 3, 2021 07:32 PM by xrahitelvip.)
You have a pretty new and good guide here for that, try it out in you own lab and learn!
https://levelup.gitconnected.com/ethical...42967f5893 |
|
|
