EvilClippy

This tool was released during our BlackHat Asia talk March 28, 2019. A video recording of this talk is available at https://www.youtube.com/watch?v=9ULzZA70Dzg. Evil Clippy A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code via P-Code and...

macphish

macphish Office for Mac Macro Payload Generator Attack vectors There are 4 attack vectors available: beacon creds meterpreter meterpreter-grant For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell. beacon On execution, this payload...

Zphisher-GUI-Back_office

Mi website: https://microjoan.com My YouTube Channel: https://www.youtube.com/c/MicroJoan DISCLAIMER This toolkit contains materials that can be potentially damaging or dangerous for social media. Refer to the laws in your province/country before accessing, using,or in any other way utilizing thi...

archiver-MOTW-support-comparison

Comparison of MOTW Mark of the Web propagation support of archiver software for Windows English | Japanese Background On 3 March 2022, Microsoft announced that the default behavior of Office applications on Windows will be changed to block macros in files from the internet such as email attachmen...

MacroShop

MacroShop Collection of scripts to aid in delivering payloads via Office Macros. Most are python. See http://khr0x40sh.wordpress.com for details. 1. macrosafe.py Generates safe for VB inclusion into an excel spreadsheet. Requires a batch file generated by Veil-Evasion powershell payloads. To...

Weaver E-Office 9.5 - Remote Code Execution

A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit h...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

CLink Office 2.0 - Cross-Site Scripting

CLink Office 2.0 is vulnerable to cross-site scripting in the index page of the management console and allows remote attackers to inject arbitrary web script or HTML via the lang parameter. id: CVE-2020-6171 info: name: CLink Office 2.0 - Cross-Site Scripting author: pikpikcu severity: medium...

Smart Office Web 20.28 - Information Disclosure

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx. id: CVE-2022-47075 info: name: Smart Office Web 20.28 - Information Disclosure author:...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch exploitation and patch video: https://www.youtube.com/watch?v=XU-U4K270Z4 Qihoo 360 blog post...

CVE-2022-30190---Follina---Poc-Exploit

Follina - CVE-2022-30190 Follina is a zero day allowing code execution in Office products. Installation git clone https://github.com/WesyHub/CVE-2022-30190---Follina---Poc-Exploit.git Usage Example : python3 FollinaSploit.py -c calc -o poc.docx -p 80 Please make sure to send the doc or rtf file t...

CVE-2026-21509-handler

CVE-2026-21509 Office Kill-Bit Manager PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting Office 2016/2019/LTSC. What is CVE-2026-21509? Critical RCE vulnerability in Microsoft Office OLE/COM handling CVSS...

CVE-2017-11882

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ Kudos, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

CVE-2023-36884-Checker

CVE-2023-36884-Checker Script to check for CVE-2023-36884 hardening https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 Goal This scripts checks if Microsoft hardening recommendations are properly applied. Microsoft says...

cve-2026-21509-office_security_bypass_reproduction

CVE-2026-21509 — Microsoft Office Security Feature Bypass CVE-2026-21509 is a Microsoft Office security feature bypass vulnerability CVSS 7.8 , actively exploited by APT28 Russian hackers against Ukraine Reliance on untrusted inputs in security decisions CWE-807 — "breaking the kill bit" Allows...

hardentools

Hardentools Hardentools is designed to disable a number of "features" exposed by Microsoft Windows 10 and 11 and some widely used applications Microsoft Office, LibreOffice and Adobe PDF Reader, for now. These features, commonly thought for enterprise customers, are generally useless to regular...

Awesome-BEC

Awesome-BEC Repository of attack and defensive information for Business Email Compromise investigations Office365/AzureAD ATT&CK O365 ATT&CK Azure Microsoft Azure Threat Research Matrix Microsoft 365 Licensing Microsoft Portals Azure App IDs Microsoft First Party App IDs & Graph Permissions...

OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

o365spray

o365spray o365spray is a username enumeration and password spraying tool aimed at Microsoft Office 365 O365. This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments. For educational, authorized and/or research purpose...

CVE-2024-38200

CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...