https://github.com/christophetd/spoofing-office-macro

:fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.
https://github.com/christophetd/spoofing-office-macro

office-macro parent-process-spoofing process-injection windows-internals windows-security

Last synced: 9 days ago
JSON representation

:fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.

• Host: GitHub
• URL: https://github.com/christophetd/spoofing-office-macro
• Owner: christophetd
• License: agpl-3.0
• Created: 2019-03-11T18:23:39.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2020-04-28T16:23:43.000Z (over 4 years ago)
• Last Synced: 2024-10-16T01:48:38.417Z (about 2 months ago)
• Topics: office-macro, parent-process-spoofing, process-injection, windows-internals, windows-security
• Language: VBA
• Homepage:
• Size: 26.4 KB
• Stars: 373
• Watchers: 19
• Forks: 84
• Open Issues: 5
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-hacking-lists - christophetd/spoofing-office-macro - :fish: PoC of a VBA macro spawning a process with a spoofed parent and command line. (VBA)

README

        
This repository contains an example of a VBA macro spawning a process with a spoofed parent and command line. Companion blog post: [Building an Office macro to spoof parent processes and command line arguments](https://blog.christophetd.fr/building-an-office-macro-to-spoof-process-parent-and-command-line)

## Demo

Click for full size.

![Demo](https://user-images.githubusercontent.com/136675/54154646-49e44780-443a-11e9-998d-ec1f54a83437.gif)

## Notes

- The 32-bit initial PoC was written and tested by myself, on Windows 10 with Office Professional Plus 2016, version 1902. 

- The 64-bit version is a contribution brought by [@py7hagoras](https://github.com/py7hagoras).

- The size of the original command line stored in [`originalCli`](https://github.com/christophetd/spoofing-office-macro/blob/master/macro.vba#L260) needs to be greater than the size of the real one stored in [`cmdStr`](https://github.com/christophetd/spoofing-office-macro/blob/master/macro.vba#L311)

## Acknowledgments & inspiration

- ["Red Teaming in the EDR age"](https://www.youtube.com/watch?v=l8nkXCOYQC4) by Will Burgess 

- https://blog.xpnsec.com/how-to-argue-like-cobalt-strike/

- https://twitter.com/subtee

## Disclaimer

You are solely responsible for the use you make of this PoC. I assume no liability for any misuse or damage caused by this program.