"Could not open file" error

[ricardojoserf]

Hello! I am testing the program and I tried to execute "mono EvilClippy.exe -g $FILENAME" with the files qqq.docm and qqq.docx. I installed Mono, downloaded the repository and included the executable file in it. The output states the file can not be found:

"""
ERROR: Could not open file qqq.docx
Please make sure this file exists and is .docm or .xlsm file or a .doc in the Office 97-2003 format.

Could not find file "/home/ricardo/EvilClippy/qqq_EvilClippy.docx"
"""

Best regards

[stanhegt]

The error that you are pasting is a docx file (without macros, Evil Clippy only works on files that contain a macro project). Can you verify whether you see the same error when opening qqq.docm? Are you sure qqq.docm contains a macro project and is in the 2007+ file format?

[ricardojoserf]

Hello @stanhegt , thank you for the instant reply! Yes, it does:
"""
ricardo@ubuntu:~/EvilClippy$ mono EvilClippy.exe -g qqq.docm
ERROR: Could not open file qqq.docm
Please make sure this file exists and is .docm or .xlsm file or a .doc in the Office 97-2003 format.

Could not find file "/home/ricardo/EvilClippy/qqq_EvilClippy.docm"
ricardo@ubuntu:~/EvilClippy$ file qqq.docm
qqq.docm: Microsoft Word 2007+
"""
I am using Ubuntu 16.04 64 bits. The docm file contains a macro named "AutoOpen" and there is code inside "NewMacros" but not inside "ThisDocument". I am using Office 16.

Regards

[stanhegt]

Would it be possible to share the sample?

[ricardojoserf]

Yes of course: https://mega.nz/#!dssnjQAA!C7wAjfgh2TP-IB8tNOeSgfxol6JKH2tkEJ0WfHLqR9A
It is a netcat reverse shell, I am testing it with a vps in DigitalOcean at the moment

[stanhegt]

This file does not contain any macros. ;-) I have verified this with OleVBA and 7zip (there's no vbaproject.bin in the ZIP container). You might have accidentally saved your macro in normal.dotm instead of this file.

[ricardojoserf]

Ouch! You are completely right. Thank you for the tool and the support! Have a good day :)

[stanhegt]

No worries, I made this mistake myself countless times. Thanks and have fun with the tool!