I see everyone trying to sell this for $500++ on various forums, the problem is that people are actually buying it. So, http://botzone1.blogspot.com is going to teach you how to create your own .doc exploit.
Things you will need:
- FUD server (it can be detected, but its going to be like 60/63)
- Metasploit (can be downloaded
here)
- Microsoft word (to test it)
The following Microsoft applications are affected:
- Microsoft Office 2007 SP3
- Microsoft Word 2007 SP3
- Microsoft Office 2010 SP1 and SP2 (32-bit and 64-bit editions)
- Microsoft Word 2010 SP1 and SP2 (32-bit and 64-bit editions)
- Microsoft Office for Mac 2011
- Microsoft Office Compatibility Pack SP3
- Microsoft SharePoint Server 2010 SP1 and SP2 with Word Automation Services
- Microsoft Word Web Apps 2010 SP2 and prior
Alrighty, lets get started.
You're going to want to fire up the metasploit pro console, it might take a few minutes for it to be ready for use.
You should be looking like this:
alright so you are going to want to type this in "cd C:\metasploit\apps\pro\msf3\tools", and then go into a new windows explorer window and place your infected file into that directory.
Unfortunatly my metasploit just crashed, so I'm going to wing the rest of the tutorial, post any questions in the comments.
alright so now we're inside of the directory, now type this "exe2vba.rb infectedfile.exe evil.vba"
now go back to your windows explorer window, and look in C:\metasploit\apps\pro\msf3\tools and you should see a file called "evil.vba".. if you dont see that file restart.
open the .vba file. There will be two sections in the file (just open it in notepad). The first part is the vba script, and the other part is the shellcode. the shell code is going to look like a bunch of numbers and letters.
exe2vba.rb infected.exe evil.vba
alright, now open up microsoft word (MUST BE A Vulnerable VERSION!!!) go to view, and select macros
copy the vb code (NOT the letters and numbers) and paste it into the first portion of the vb file
save it as a word97-2003Doc. alright, almost done! Now open the document and paste the shell code (letters & numbers) into the document, and save it again. Congratz, you just made the exploit, was it still worth $500? that's what I thought.... I'm going to be posting a tutorial on how to make it completely fud very soon.
c:\metasploit\apps\pro\msf3\tools
c:\metasploit\apps\pro\msf3\tools
c:\metasploit\apps\pro\msf3\tools
