Skip to content

Commit 6e692b1

Browse files
committed
Update doc
1 parent f3f774b commit 6e692b1

File tree

1 file changed

+10
-6
lines changed

1 file changed

+10
-6
lines changed

documentation/modules/exploit/windows/fileformat/office_word_macro.md

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
## Description
22

3-
This module generates a macro-enabled Microsoft Office Word document.
3+
This module generates a macro-enabled Microsoft Office Word document. It does not target a specific
4+
CVE or vulnerability, this is more of a feature-abuse in Office, however this type of
5+
social-engineering attack still remains common today.
46

5-
The module injects the Base64-encoded payload in the comments field, which will get decoded
6-
back by the macro and executed as a Windows executable when the Office document is launched.
7+
There are many ways to create this type of malicious doc. The module injects the Base64-encoded
8+
payload in the comments field, which will get decoded back by the macro and executed as a Windows
9+
executable when the Office document is launched.
710

8-
Please note that the user most likely will need to manually allow/enable the macro to run
9-
in order to be compromised.
11+
Please note: By default, Microsoft Office does not execute macros automatically. If a macro is
12+
present, the user will most likely need to manually click on the "Enable Content" button in order
13+
to run the macro.
1014

1115

1216
## Vulnerable Application
@@ -29,7 +33,7 @@ Specifically, this module was tested specifically against:
2933

3034
## Options
3135

32-
**BODY** Text to put in the Office document.
36+
**BODY** Text to put in the Office document. See **Modification** below if you wish to modify more.
3337

3438
## Demo
3539

0 commit comments

Comments
 (0)