File tree Expand file tree Collapse file tree 1 file changed +10
-6
lines changed
documentation/modules/exploit/windows/fileformat Expand file tree Collapse file tree 1 file changed +10
-6
lines changed Original file line number Diff line number Diff line change 1
1
## Description
2
2
3
- This module generates a macro-enabled Microsoft Office Word document.
3
+ This module generates a macro-enabled Microsoft Office Word document. It does not target a specific
4
+ CVE or vulnerability, this is more of a feature-abuse in Office, however this type of
5
+ social-engineering attack still remains common today.
4
6
5
- The module injects the Base64-encoded payload in the comments field, which will get decoded
6
- back by the macro and executed as a Windows executable when the Office document is launched.
7
+ There are many ways to create this type of malicious doc. The module injects the Base64-encoded
8
+ payload in the comments field, which will get decoded back by the macro and executed as a Windows
9
+ executable when the Office document is launched.
7
10
8
- Please note that the user most likely will need to manually allow/enable the macro to run
9
- in order to be compromised.
11
+ Please note: By default, Microsoft Office does not execute macros automatically. If a macro is
12
+ present, the user will most likely need to manually click on the "Enable Content" button in order
13
+ to run the macro.
10
14
11
15
12
16
## Vulnerable Application
@@ -29,7 +33,7 @@ Specifically, this module was tested specifically against:
29
33
30
34
## Options
31
35
32
- ** BODY** Text to put in the Office document.
36
+ ** BODY** Text to put in the Office document. See ** Modification ** below if you wish to modify more.
33
37
34
38
## Demo
35
39
You can’t perform that action at this time.
0 commit comments