Carrie Roberts clr2of8

## test1.txt
test

## index1.html
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Hello World!</title>
</head>
<body>
Hello World!
  <script>alert(1)</script>
</body>

## testcc.js
var webSocketDebuggerUrl;
var port = 9666;
var request = new XMLHttpRequest();
request.open("GET", "http://localhost:" + port + "/json");
request.responseType = 'json';
request.send();
request.onload = function() {
 webSocketDebuggerUrl = request.response[0].webSocketDebuggerUrl;
 console.log(webSocketDebuggerUrl);


## Various-Macro-Based-RCEs.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                clr2of8
                / Various-Macro-Based-RCEs.md
            
            
              Created
              March 14, 2019 14:59
                — forked from mgeeky/Various-Macro-Based-RCEs.md
            
              
                Various Visual Basic Macros-based Remote Code Execution techniques to get your meterpreter invoked on the infected machine.
              
          
    This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector.
Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.
All of the below examples had been generated for using as a remote address: 192.168.56.101.
List:

Page substiution macro for luring user to click Enable Content
The Unicorn Powershell based payload


## rtf_with_multiple_embedded_docs
rule rtf_with_multiple_embedded_docs
{
     meta:
          description = "RTF file with multiple embedded macro-enabled documents"
          weight  = 90
          author = "Walmart Information Security"
          date = "2019-03-14"

     strings:
          // Headers of files to look for

## rtf_with_embedded_macro_enabled_office_document
rule rtf_with_embedded_macro_enabled_office_document
{
     meta:
          description = "RTF file with multiple embedded macro-enabled documents"
          weight  = 90
          author = "Walmart Information Security"
          date = "2019-03-14"

     strings:
          // Headers of files to look for

## groupenumeration.ps1
Get-AdGroup -Filter * | % { Get-AdGroupMember $_.Name | Select-Object -ExpandProperty SamAccountName | Out-File -FilePath "$($_.Name).txt" -Encoding ASCII }

## test.bat
# comment
dir

## mt_path-normalization.bat
REM Path Normalization (spaces and single trailing periods are removed, forward slashes changed to backslashes)
c:\Windows.\System32.\notepad.exe
"c:\Windows\System32    \notepad.exe"
c:/Windows/System32\notepad.exe
//.\c:\Windows/System32/notepad.exe
"c:\Windows.\System32. .   ./notepad.exe"

## mt_fully-qualified-DOS-paths.bat
REM Fully Qualified DOS Paths (begins with a drive letter, a volume separator, and a component separator)
c:\Windows\System32\notepad.exe

REM Environment Variables
%SystemRoot%\System32\notepad.exe
%HomeDrive%Windows\System32\notepad.exe
	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="utf-8">
	<title>Hello World!</title>
	</head>
	<body>
	Hello World!
	<script>alert(1)</script>
	</body>
	var webSocketDebuggerUrl;
	var port = 9666;
	var request = new XMLHttpRequest();
	request.open("GET", "http://localhost:" + port + "/json");
	request.responseType = 'json';
	request.send();
	request.onload = function() {
	webSocketDebuggerUrl = request.response[0].webSocketDebuggerUrl;
	console.log(webSocketDebuggerUrl);
	rule rtf_with_multiple_embedded_docs
	{
	meta:
	description = "RTF file with multiple embedded macro-enabled documents"
	weight = 90
	author = "Walmart Information Security"
	date = "2019-03-14"

	strings:
	// Headers of files to look for
	rule rtf_with_embedded_macro_enabled_office_document
	{
	meta:
	description = "RTF file with multiple embedded macro-enabled documents"
	weight = 90
	author = "Walmart Information Security"
	date = "2019-03-14"

	strings:
	// Headers of files to look for
	REM Path Normalization (spaces and single trailing periods are removed, forward slashes changed to backslashes)
	c:\Windows.\System32.\notepad.exe
	"c:\Windows\System32 \notepad.exe"
	c:/Windows/System32\notepad.exe
	//.\c:\Windows/System32/notepad.exe
	"c:\Windows.\System32. . ./notepad.exe"
	REM Fully Qualified DOS Paths (begins with a drive letter, a volume separator, and a component separator)
	c:\Windows\System32\notepad.exe

	REM Environment Variables
	%SystemRoot%\System32\notepad.exe
	%HomeDrive%Windows\System32\notepad.exe