Malicious Macro MSBuild Generator v2.1
Description
Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass, this tool intended for adversary simulation and red teaming purpose.
Disclaimer
MaliciousMacroMSBuild should be used for authorized red teaming and/or nonprofit educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.
Changelog
Version 2.1
-----------
+ Added sandbox evasion technique using environmental keying domain checking
+ Added Kill Date format dd/mm/yyyy [28/02/2018]
+ Move payload from public user to current user download folder
Version 2.0
-----------
+ Added Option Macro AMSI Bypass (Thanks to outflank team)
+ Added PPID Spoofing {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
+ Added functionality auto removed csproj payload after execution
+ Added custom msbuild option
Usage
/$$ /$$ /$$$$$$ /$$$$$$
| $$$ /$$$ /$$__ $$ /$$__ $$
| $$$$ /$$$$|__/ \ $$| $$ \__/
| $$ $$/$$ $$ /$$$$$/| $$ /$$$$
| $$ $$$| $$ |___ $$| $$|_ $$
| $$\ $ | $$ /$$ \ $$| $$ \ $$
| $$ \/ | $$| $$$$$$/| $$$$$$/
|__/ |__/ \______/ \______/
Malicious Macro MSBuild Generator v2.1
Author : Rahmat Nurfauzi (@infosecn1nja)
usage: m3-gen.py [-h] -i INPUTFILE -p PAYLOAD -o OUTPUT [-a] [-d DOMAIN]
[-k KILL_DATE]
optional arguments:
-h, --help show this help message and exit
-i INPUTFILE, --inputfile INPUTFILE
Input file you want to embed into the macro
-p PAYLOAD, --payload PAYLOAD
Choose a payload for powershell, raw shellcode or custom
-o OUTPUT, --output OUTPUT
Output filename for the macro
-a, --amsi_bypass Macro AMSI Bypass Execute via ms office trusted location
-d DOMAIN, --domain DOMAIN
Sandbox evasion technique using environmental keying domain checking. Use comma separating to set multiple domains
-k KILL_DATE, --kill_date KILL_DATE
Set kill date format dd/MM/yyyy the payload do not run on or after this day
Examples
- Choose a payload you want to test like shellcode or powershell, the shellcode support stageless and staged payload
- Generate a raw shellcode in whatever framework you want (Cobalt Strike, Empire, PoshC2)
Creation of a Shellcode MSBuild VBA Macro
python m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba
Creation of a PowerShell MSBuild VBA Macro
python m3-gen.py -p powershell -i /path/payload.ps1 -o output.vba
Creation of a Custom MSBuild VBA Macro
python m3-gen.py -p custom -i /path/msbuild.xml -o output.vba
Creation of a Shellcode MSBuild VBA Macro With Kill Date
python m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba -k 20/03/2018
Creation of a Shellcode MSBuild VBA Macro With Environmental Keying
python m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba -d yourdomainpython m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba -d yourdomain, microsoft, github
Links
- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
- https://attack.mitre.org/techniques/T1127/
- https://msdn.microsoft.com/en-us/library/dd722601.aspx
Author and Credits
Author : Rahmat Nurfauzi - @infosecn1nja
Credits : @subTee - For discovering msbuild technique