Add doc

Author: wchen-r7

documentation/modules/exploit/windows/fileformat/office_word_macro.md

@@ -0,0 +1,45 @@
+## Description
+
+This module generates a macro-enabled Microsoft Office Word document.
+
+The module injects the Base64-encoded payload in the comments field, which will get decoded
+back by the macro and executed as a Windows executable when the Office document is launched.
+
+Please note that the user most likely will need to manually allow/enable the macro to run
+in order to be compromised.
+
+
+## Vulnerable Application
+
+A Windows machine with Microsoft Office installed. The Office application must support the docm
+format.
+
+Specifically, this module was tested specifically against Microsoft Office 2013.
+
+## Verification Steps
+
+1. ```use exploit/windows/fileformat/office_word_macro```
+2. ```set PAYLOAD [PAYLOAD NAME]```
+3. Configure the rest of the settings accordingly (BODY, LHOST, LPORT, etc)
+4. ```exploit```
+5. The module should generate the malicious docm.
+
+## Options
+
+**BODY** Text to put in the Office document.
+
+## Modification
+
+To use this exploit in a real environment, you will most likely need to modify the docm content.
+Here's one approach you can do:
+
+1. Use the module to generate the malicious docm
+2. Copy the malicious docm to a Windows machine, and edit it with Microsoft Office (such as 2013).
+   When you open the document, the payload will probably do something on your machine. It's ok,
+   since you generated it, it should not cause any problems for you.
+3. Save the doc, and test again to make sure the payload still works.
+
+While editing, you should avoid modifying the following unless you are an advanced user:
+
+* The comments field.
+* The VB code in the macro.