Hacking Articles Tips Tricks Videos Tutorials

same name being dropped in it's place. To the undiscerning eye, it will appear that the XLSX was there the entire time. Unfortunately the location where the XLL is deleted and the XLSX dropped is the appdata\temp\local folder, not the original ZIP; to address…

xTmUCbXDt5yQ/w640-h392/XLL_Phishing_18.png Yikes. Truth be told I have no idea where the keylogging, encrypting, and decrypting credentials alerts are coming from as my code doesn't do any of that. Our actions sure look suspicious when laid out like this, but I will again comment on just how much data is collected by MDE on a single endpoint, let alone hundreds, thousands, or hundreds of thousands that an organization may have hooked into the EDR. So long as we aren't throwing any actual alerts, we are probably ok. Code SampleThe moment most have probably been waiting for, I am providing a code sample of my developed XLL runner, limited to just those parts discussed here in the Tradecraft section. It will be on the reader to actually get the code into an XLL and implement it in conjunction with the rest of their runner. As always, do no harm, have permission to phish an organization, etc. Compiling and setupI have included the source code for a program that will ingest a file and produce hex which can be copied into the byte arrays defined in the snippet. Use this on the the XLSX you wish to present to the user, as well as the ZIP file containing the folder which contains that same XLSX and store them in their respective byte arrays. Compile this code using: gcc -o ingestfile ingestfile.c I had some issues getting my XLL's to compile using MingW on a kali machine so thought I would post the commands here:

x64

x86_64-w64-mingw32-gcc snippet.c 2013_Office_System_Developer_Resources/Excel2013XLLSDK/LIB/x64/XLCALL32.LIB -o importantdoc.xll -s -Os -DUNICODE -shared -I 2013_Office_System_Developer_Resources/Excel2013XLLSDK/INCLUDE/

x86

i686-w64-mingw32-gcc snippet.c 2013_Office_System_Developer_Resources/Excel2013XLLSDK/LIB/XLCALL32.LIB -o HelloWorldXll.xll -s -DUNICODE -Os -shared -I 2013_Office_System_Developer_Resources/Excel2013XLLSDK/INCLUDE/

After you compile you will want to make a new folder and copy the XLL into that folder. Then zip it using: zip -r Note that in order for the tradecraft outlined in this post to work, you are going to need to match some variables in the code snippet to what you name the XLL and the zip file. ConclusionWith the dominance of Office Macro's coming to a close, XLL's present an attractive option for phishing campaigns. With some creativity they can be used in conjunction with other techniques to bypass many layers of defenses implemented by organizations and security teams. Thank you for reading and I hope you learned something useful! Download XLL_Phishing

___________________________
@hacking_Attack
@Hacking_Video

10 viewsedited 14:29

Hacking Articles Tips Tricks Videos Tutorials

8 views15:16

Hacking Articles Tips Tricks Videos Tutorials

8 views15:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Chrome LinkToTextMenuObserver::CompleteWithError Heap Use-After-Free

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
A use-after-free issue exists in Chrome 104 and earlier versions. Processing maliciously crafted web content may lead to arbitrary code execution in the browser process. LinkToTextMenuObserver holds a raw pointer to a RenderFrameHost object, but is not owned by the frame host and does not watch for frame host destruction events. Therefore, if an attacker manages to destroy the frame host right after the observer is created but before the timeout task posted in StartLinkGenerationRequestWithTimeout() is executed, use-after-free will occur.

SHA-256 | 071c2f32b441a15bf0f0c6db3397a3899a646938aeb7df15abb5fc345c9589e8

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video