Module 5

📘Learning Objectives📘

After completing this assignment, you will be able to:

1. Create and embed malicious macros into Microsoft Office documents to deliver payloads
2. Backdoor legitimate Windows executables to maintain covert access
3. Use stolen credentials with Metasploit's PSExec module to gain remote access
4. Enumerate a compromised host using Meterpreter and identify valuable information for lateral movement
5. Establish initial access via Remote Desktop Protocol (RDP) using compromised credentials
6. Document each technique with screen recordings, command output, and explanations of attacker value

📜Background📜

Initial access is a critical phase in the cyber kill chain. Threat actors use multiple techniques to gain a foothold inside a target network. This assignment covers four primary initial access and execution methods used in penetration testing and observed in real-world attacks:

Malicious Macros: Microsoft Office macros (VBA) are commonly weaponized in phishing campaigns. A macro embedded in a Word document can download and execute arbitrary code when the document is opened and macros are enabled. This technique is widely used by threat groups such as APT28 (Fancy Bear), FIN7, Kimsuky, and APT32 (OceanLotus), as well as various financially motivated actors.

• Backdoored Executables:

  • Threat actors modify legitimate software to include hidden backdoors. When a user runs the backdoored program, the legitimate application functions normally while a covert payload executes in the background. Supply chain attacks and trojanized software distribution are common delivery mechanisms.

• Credential-Based Access (PSExec):

  • Stolen credentials can be leveraged with tools like Sysinternals PSExec to execute commands on remote systems. Metasploit provides a PSExec module that authenticates via SMB and deploys a Meterpreter session, mimicking lateral movement techniques used by threat actors who have harvested credentials from a compromised environment.

• Remote Desktop Protocol (RDP):

  • RDP provides graphical remote access to Windows systems. While RDP is more commonly documented as a lateral movement technique (T1021.001), threat actors also use it for initial access when they obtain valid credentials through phishing or credential dumps. Groups such as Scattered Spider, LAPSUS$, and Wizard Spider have leveraged compromised credentials for RDP-based access. RDP sessions blend with legitimate remote administration activity, making detection difficult.

👊MITRE ATT&CK Reference👊

• T1566 - Phishing
• T1204 - User Execution
• T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain
• T1021.001 - Remote Services: Remote Desktop Protocol
• T1133 - External Remote Services
• T1078 - Valid Accounts
• T1059.005 - Command and Scripting Interpreter: Visual Basic
• T1059.001 - Command and Scripting Interpreter: PowerShell
• T1055 - Process Injection
• T1036 - Masquerading

🌹Lab Environment Setup🌹

Use your Windows 10 VM on Proxmox. You need standard user (champuser) and administrator access.

💻Pre-requisites💻

1. Install Microsoft Word on your Windows 10 host using the provided installer as champuser:
   • https://tinyurl.com/2wfxfyb5
2. Extract the file and double-click on the ‘install’ script.
3. Wait for the install to finish. When it completes, it will have installed Microsoft Word.
4. Ensure Metasploit Framework is installed on your Kali/attack VM
5. Have network connectivity between your attack VM and the Windows 10 target
6. Perform all tasks as champuser unless otherwise specified

🌲Tasks🌲

🌹Task 1: Macro Creation and Delivery (25 points)🌹

• ⭐Objective⭐
  • Create a malicious macro in Microsoft Word that downloads and executes a payload, demonstrating the technique threat actors use in phishing campaigns.

Task 1

🌹Task 2: Backdoor an Executable (25 points)🌹

• ⭐Objective⭐
  • Add a backdoor to a legitimate Windows program that you’d use on a day-to-day basis , demonstrating how supply chain attacks and trojanized software can be used to maintain covert access.

Task 2

🌹Task 3: Credential-Based Lateral Movement with PSExec (25 points)🌹

• ⭐Objective⭐
  • Use stolen credentials with Metasploit's PSExec module to gain remote access to the target system and enumerate it using Meterpreter.

Task 3

🌹Task 4: RDP as Initial Access (25 points)🌹

• ⭐Objective⭐
  • Enable Remote Desktop Protocol on the target system and establish a graphical remote session using compromised credentials, demonstrating how attackers use RDP for hands-on-keyboard access and lateral movement.

Task 4