The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Exe2VBA - Tool for Converting Backdoors to VBA Macros
------------------------------------------------------------------------
SUMMARY
DETAILS
Why macros are a big security threat?
The answer is easy. Many companies use VBA macros for their daily work.
You can do nearly everything within a macro. This includes:
* Writing and manipulation of Binary and Textfiles.
* You can use the whole Windows-API within macros
* You can launch shell interpreter (cmd.exe)
* Much more...
Penetration testers often overlook this thread. If only one user in a
company use macros and open your faked document, you have got a remote
commando execution flaw.
How to compile vbatoexe?
I compiled it with the free lcc compiler. Download it from
<http://www.cs.virginia.edu/~lcc-win32/>
http://www.cs.virginia.edu/~lcc-win32/ I simply type (cmd.exe):
lc vbatoexe.c
How to compile backdoors?
Backdoors should be very small. First compile your file with:
lc NameOfYourBackdoor.c
Now strip the objectfile by running:
lcclnk -s NameOfYourBackdoor.obj
The result is a small NameOfYourBackdoor.exe file.
How the example macros works?
The examples use a very simple technique. Change to a writable home
directory (%userprofile% environment). Open Binary file whlp32.exe and
write raw binary data (our backdoor) to file. Finally launch the file
(backdoor). Source Code is well documented (exetovba.c). Change it to your
needs.
How can I test the examples?
Enable Macro within Word or Excel. Change to examples folder.
portbind.doc/xls: Double click on it. Open shell (cmd.exe) and type
"telnet 127.0.0.1 12345". Now you should see a shell.
reverse.doc/xls: Download and install netcat (nc.exe). Open shell and type
"nc -l -p 12345". Double click on Word or Excel file. Now you should get a
shell (Reverse connect).
How to use this package for penetration testers?
Copy portbind.doc/xls to your directory. Rename it (bill.doc,
calculation.xls, ...). Create a small table within Excel or Word with
faked data. Send mail with spoofed From field (use a name of an employee
in your company). Now make a portscan of your local network. If you see
port 12345 open, you can connect to this port with telnet (telnet RemoteIP
12345) and you have got a remote shell to your victim.
Where can I find good backdoors?
Shellcodes are very good backdoors. They are small and you can gain remote
shell, download file, .... The best way to create platform independent
shellcodes is at <http://www.metasploit.com> Metasploit. This site
contains a very powerful shellcode generation tool.
How to create my own macro VBA backdoors?
Portbind and Reverse are only examples of backdoors. If you want to break
into a computer you often need specially crafted backdoors. Do the
following to create your own macro backdoors. Compile and Strip your
backdoor to reduce size. Then launch:
vbatoexe.exe [1/2] YourBackdoor.exe > backdoor.txt
Use 1 for Word- and 2 for Excel source code.
Open a new document. Create a new macro with any name. Edit macro and
delete everything. Open backdoor.txt and copy all the text to your macro.
Save file. If you open your new file, your backdoor will be launched. Now
connect to your backdoor. If everything works fine, you can send it to
your victim. You can use httptunnel to forward your victims network to
your computer for example. Reverse connect often works if you can connect
to the Internet without a proxy. Portbind backdoor is good in a local
network. There are many possibilities. Be creative.
Additions:
The best Office programs to launch macro based attacks are MS-Word and
MS-Excel. It's also possible with other Office progarms, but macros
normally used within MS-Word ans MS-Excel.
ADDITIONAL INFORMATION
The information has been provided by <mailto:priest@priestmaster.org>
priestmaster.
To keep updated with the tool visit the project's homepage at:
<http://www.priestmaster.org/tools.html>
http://www.priestmaster.org/tools.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
