{"id":4193,"date":"2017-04-19T01:22:36","date_gmt":"2017-04-19T01:22:36","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4193"},"modified":"2017-05-19T08:32:59","modified_gmt":"2017-05-19T08:32:59","slug":"beyond-good-ol-run-key-part-62","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/04\/19\/beyond-good-ol-run-key-part-62\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 62"},"content":{"rendered":"

Update<\/strong><\/p>\n

This is not an RCE. If it was, I would not publish it on this blog \ud83d\ude42<\/p>\n

Turns out “Simpsons already did it” and as pointed out by @arekfurt<\/a> a normal<\/em> template-based persistence is already implemented in EmpireProject<\/a> and is based on awesome work<\/a> of @enigma0x3<\/a>. Interestingly, enabling macros is not needed to deliver the same functionality (as explained below).<\/p>\n

Dropping any macro sheet inside the XLSTART folder and opening it from there will not show the macro warning \ud83d\ude42<\/p>\n

Old Post<\/strong><\/p>\n

Every once in a while we come across weird things that we not only discover accidentally, but are finding hard to understand. Today I was playing around with Word Macros and to my surprise I was able to accidentally run one, while my Macro Options were set to Disable all macros with notification<\/em>.<\/p>\n

\"\"<\/a>Intrigued, I quickly realized that instead of adding it to a test word document, I accidentally added it to the normal<\/em> template file.<\/p>\n

Could it be… ?<\/p>\n

I rushed to add the AutoOpen<\/em> macro to the normal<\/em> template that will launch the Calculator anytime the template is used:<\/p>\n

\"\"<\/a>Now I only needed to open some word document…<\/p>\n

\"\"<\/a>How nice!<\/p>\n

Interestingly, the Security Warning appears ONLY after I visit options while the document is open.<\/p>\n

\"\"<\/a>Swap calculator with anything else, and a new stealth persistence mechanism is born…<\/p>\n

Now, what about Excel?<\/p>\n

Excel doesn’t have the Normal<\/em> template equivalent by default, but you can add one. To do so, you just need to record any macro named Auto_Open<\/em> and store it inside a personal template (by choosing ‘Store macro in Personal Macro Workbook<\/em>‘):<\/p>\n

\"\"<\/a><\/p>\n

(alternatively, you can create a personal template directly on the system by placing a prepared XLSB file in a following location: c:\\Users\\<USER>\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB<\/em>)<\/p>\n

Then switch to the macro editor, and write the code as below:<\/p>\n

\"\"<\/a><\/p>\n

This will ensure the Calculator will be executed anytime someone opens Excel, even if the macros are *cough* *cough* disabled…<\/p>\n","protected":false},"excerpt":{"rendered":"

Update This is not an RCE. If it was, I would not publish it on this blog \ud83d\ude42 Turns out “Simpsons already did it” and as pointed out by @arekfurt a normal template-based persistence is already implemented in EmpireProject and … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,46,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4193"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4193"}],"version-history":[{"count":8,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4193\/revisions"}],"predecessor-version":[{"id":4230,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4193\/revisions\/4230"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}