[TOOL] Exe2VBA - Tool for Converting Backdoors to VBA Macros

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Exe2VBA - Tool for Converting Backdoors to VBA Macros
------------------------------------------------------------------------


SUMMARY



DETAILS

Why macros are a big security threat?
The answer is easy. Many companies use VBA macros for their daily work. 
You can do nearly everything within a macro. This includes:
 * Writing and manipulation of Binary and Textfiles.
 * You can use the whole Windows-API within macros
 * You can launch shell interpreter (cmd.exe)
 * Much more...

Penetration testers often overlook this thread. If only one user in a 
company use macros and open your faked document, you have got a remote 
commando execution flaw.

How to compile vbatoexe?
I compiled it with the free lcc compiler. Download it from  
<http://www.cs.virginia.edu/~lcc-win32/> 
http://www.cs.virginia.edu/~lcc-win32/ I simply type (cmd.exe):
lc vbatoexe.c

How to compile backdoors?
Backdoors should be very small. First compile your file with:
lc NameOfYourBackdoor.c

Now strip the objectfile by running:
lcclnk -s NameOfYourBackdoor.obj

The result is a small NameOfYourBackdoor.exe file.

How the example macros works?
The examples use a very simple technique. Change to a writable home 
directory (%userprofile% environment). Open Binary file whlp32.exe and 
write raw binary data (our backdoor) to file. Finally launch the file 
(backdoor). Source Code is well documented (exetovba.c). Change it to your 
needs.

How can I test the examples?
Enable Macro within Word or Excel. Change to examples folder.
portbind.doc/xls: Double click on it. Open shell (cmd.exe) and type 
"telnet 127.0.0.1 12345". Now you should see a shell.
reverse.doc/xls: Download and install netcat (nc.exe). Open shell and type 
"nc -l -p 12345". Double click on Word or Excel file. Now you should get a 
shell (Reverse connect).

How to use this package for penetration testers?
Copy portbind.doc/xls to your directory. Rename it (bill.doc, 
calculation.xls, ...). Create a small table within Excel or Word with 
faked data. Send mail with spoofed From field (use a name of an employee 
in your company). Now make a portscan of your local network. If you see 
port 12345 open, you can connect to this port with telnet (telnet RemoteIP 
12345) and you have got a remote shell to your victim.

Where can I find good backdoors?
Shellcodes are very good backdoors. They are small and you can gain remote 
shell, download file, .... The best way to create platform independent 
shellcodes is at  <http://www.metasploit.com> Metasploit. This site 
contains a very powerful shellcode generation tool.

How to create my own macro VBA backdoors?
Portbind and Reverse are only examples of backdoors. If you want to break 
into a computer you often need specially crafted backdoors. Do the 
following to create your own macro backdoors. Compile and Strip your 
backdoor to reduce size. Then launch:
vbatoexe.exe [1/2] YourBackdoor.exe > backdoor.txt
Use 1 for Word- and 2 for Excel source code.

Open a new document. Create a new macro with any name. Edit macro and 
delete everything. Open backdoor.txt and copy all the text to your macro. 
Save file. If you open your new file, your backdoor will be launched. Now 
connect to your backdoor. If everything works fine, you can send it to 
your victim. You can use httptunnel to forward your victims network to 
your computer for example. Reverse connect often works if you can connect 
to the Internet without a proxy. Portbind backdoor is good in a local 
network. There are many possibilities. Be creative.

Additions:
The best Office programs to launch macro based attacks are MS-Word and 
MS-Excel. It's also possible with other Office progarms, but macros 
normally used within MS-Word ans MS-Excel.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
priestmaster.
To keep updated with the tool visit the project's homepage at:  
<http://www.priestmaster.org/tools.html> 
http://www.priestmaster.org/tools.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.