MacroShop

MacroShop Officeマクロを介してペイロードを配信するためのスクリプト集。ほとんどはPythonです。詳細は http://khr0x40sh.wordpress.com を参照してください。 1. macrosafe.py ExcelスプレッドシートにVBとして含めるための安全なコードを生成します。Veil-EvasionのPowerShellペイロードによって生成されたバッチファイルが必要です。組み込むには、Officeの開発者メニューを有効にし、Visual...

Vba2Graph

Vba2Graph 悪意のあるOfficeマクロの解析に時間を浪費するセキュリティ研究者のためのツール。 VBAコールグラフを生成し、潜在的に悪意のあるキーワードをハイライト表示します。 悪意のあるマクロの迅速な解析と、実行フローの容易な理解を可能にします。 @MalwareCantFly 特徴 キーワードハイライト VBAプロパティ対応 外部関数宣言対応 "Change" 実行トリガーを使った巧妙なマクロ対応 派手なカラースキーム！ 長所 ✓ 非常に高速 ✓ 実際に観測されるほとんどの悪意あるマクロで良好に動作 短所 ✗ 静的解析（動的に解決されるコールは認識されない） 使用例 例1:...

Mystikal

Mystikal macOS 初始访问载荷生成器 旨在与 https://github.com/its-a-feature/Mythic 配合使用 相关博文： https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 用法： 1. 在构建机上安装 Xcode（安装程序包与安装程序插件需要） 2. 安装 python 依赖 root@kitploit: sudo pip3 install -r requirements.txt 3. 修改 Settings/MythicSettings.py 文件中的设置以匹配你的 Myth...

luckystrike

luckystrike PowerShellベースの悪意のあるOfficeマクロ文書作成ユーティリティ。ペネトレーションテストまたは教育目的のみに使用すること。 はじめに 1. こちらをお読みください: http://www.shellntel.com/blog/2016/9/13/luckystrike-a-database-backed-evil-macro-generator. 2. Wikiをお読みください! 3. Win7-10マシン（32ビットまたは64ビット）を使用していることを確認してください。 4...

Simple Steps for Attack Surface Reduction

Story teaser text: Cybersecurity leaders face mounting pressure to stop attacks before they start, and the best defense may come down to the settings you choose on day one. In this piece, Yuriy Tsibere explores how default policies like deny-by-default, MFA enforcement, and application Ringfencin...

📄 Microsoft Excel LTSC 2024 Remote Code Execution

Microsoft Excel LTSC 2024 suffers from a remote code execution vulnerability. Titles: Microsoft Excel LTSC 2024 - Remote Code Execution RCE Author: nu11secur1ty Date: 06/16/2025 Vendor: Microsoft Software: https://www.microsoft.com/en/microsoft-365/excel?market=af Reference:...

New Attack Technique Exploits Microsoft Management Console Files

Threat actors are exploiting a novel attack technique in the wild that leverages specially crafted management saved console MSC files to gain full code execution using Microsoft Management Console MMC and evade security defenses. Elastic Security Labs has codenamed the approach GrimResource after...

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection. "Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel XLM 4.0 to trick...

Microsoft Patch Tuesday, July 2022 Edition

Microsoft today released updates to fix at least 86 security vulnerabilities in its Windows operating systems and other software, including a weakness in all supported versions of Windows that Microsoft warns is actively being exploited. The software giant also has made a controversial decision t...

Microsoft Patch Tuesday, February 2022 Edition

Microsoft today released software updates to plug security holes in its Windows operating systems and related software. This months relatively light patch batch is refreshingly bereft of any zero-day threats, or even scary critical vulnerabilities. But it does fix four dozen flaws, including...

Hackers Now Hiding ObliqueRAT Payload in Images to Evade Detection

Cybercriminals are now deploying remote access Trojans RATs under the guise of seemingly innocuous images hosted on infected websites, once again highlighting how threat actors quickly change tactics when their attack methods are discovered and exposed publicly. New research released by Cisco Tal...

Malicious MS Office Macro Creator

Evil Clippy is a tool for creating malicious Microsoft Office macros: At BlackHat Asia we released Evil Clippy, a tool which assists red teamers and security testers in creating malicious MS Office documents. Amongst others, Evil Clippy can hide VBA macros, stomp VBA code via p-code and confuse...

wePWNise - Generates Architecture Independent VBA Code To Be Used In Office Documents Or Templates And Automates Bypassing Application Control And Exploit Mitigation Software

wePWNise is proof-of-concept Python script which generates VBA code that can be used in Office macros or templates. It was designed with automation and integration in mind, targeting locked down environment scenarios. The tool enumerates Software Restriction Policies SRPs and EMET mitigations and...

New Malware Family Uses Custom UDP Protocol for C&C Communications

Security researchers have uncovered a new highly-targeted cyber espionage campaign, which is believed to be associated with a hacking group behind KHRAT backdoor Trojan and has been targeting organizations in South East Asia. According to researchers from Palo Alto, the hacking group, which they...

“Ready Player One” – Are you Ready to Protect Your Endpoints from the Bad Guys?

At times it can feel like a game as you watch the cyber-breach scorecards. Yahoo 3 billion users, Equifax 143 million consumers, Uber 57 million users, Imgur 1.7 million users are just a sample of the companies that have released new information on large breaches in the last few months...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...

CVE-2016-0141

The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."...

MacroShop - Collection of scripts to aid in delivering payloads via Office Macros

Collection of scripts to aid in delivering payloads via Office Macros. Most are python. 1. macrosafe.py Generates safe for VB inclusion into an excel spreadsheet. Requires a batch file generated by Veil-Evasion powershell payloads. To include, enable the developer menu in Office, head to Visual...

Microsoft Office Macros Configuration

Nessus was able to collect Office macro configuration information for active accounts on the remote Windows host and generate a report as a CSV attachment. C Tenable Network Security, Inc. include"compat.inc"; if !definedfunc"nasllevel" || nasllevel 5200 exit0, "Not Nessus 5.2+"; if description...

Dridex Banking Trojan Spreading Via Office Macros

The left-for-dead Office macro has apparently made a comeback with cybercriminals who have found them to be a good hiding place for banking malware. Recently, Microsoft reported a spike in the use of macros in hacking campaigns, peaking in mid-December. This has been corroborated by researchers a...