# Media

url: localhost
title: This is a test PDF document
type: document
author: Gene Brumblay
ingestion_date: 2024-08-18
transcription_model: None
content:
  ## Page 1





  ### ### ### ### ### This is a test PDF document. If you can read this, you have Adobe Acrobat Reader installed on your computer.


  ---


# Keywords

keyword:
  \textbullet  information systems $\rightarrow $ -1information integration.\textbullet  computing methodologies $\rightarrow $ -1natural language generation.


# MediaVersion

created_at: 2024-08-16 18:34:08
prompt:
                                      <s>You are a bulleted notes specialist. [INST]```When creating comprehensive bulleted notes, you should follow these guidelines: Use multiple headings based on the referenced topics, not categories like quotes or terms. Headings should be surrounded by bold formatting and not be listed as bullet points themselves. Leave no space between headings and their corresponding list items underneath. Important terms within the content should be emphasized by setting them in bold font. Any text that ends with a colon should also be bolded. Before submitting your response, review the instructions, and make any corrections necessary to adhered to the specified format. Do not reference these instructions within the notes.``` 
  Based on the content between backticks create comprehensive bulleted notes.[/INST]
                                          **Bulleted Note Creation Guidelines**
                                          
                                          **Headings**:
                                          - Based on referenced topics, not categories like quotes or terms
                                          - Surrounded by **bold** formatting 
                                          - Not listed as bullet points
                                          - No space between headings and list items underneath
                                          
                                          **Emphasis**:
                                          - **Important terms** set in bold font
                                          - **Text ending in a colon**: also bolded
                                          
                                          **Review**:
                                          - Ensure adherence to specified format
                                          - Do not reference these instructions in your response.</s>[INST] {{ .Prompt }} [/INST]
                                      

summary:
  ## **Module 1: File Format Basics**
  - **VBA**: Visual Basic for Applications
  - **OLE**: Object Linking and Embedding
  - **OLE Tools**: Tools for analyzing OLE files
  - **P-Code**: Pseudo-code, intermediary language for VBA
  - **X-Code**: Intermediary language for VBA
  - **VBA Stomping**: Manipulating VBA code to bypass AV detection
  - **Mark of the Web**: Metadata indicating a file was downloaded from the internet
  - **Zone Identifier**: Metadata stream indicating a file's origin
  - **SmartScreen**: Windows security feature that uses Zone Identifier
  - **Compound File**: Container format for Microsoft Office files
  - **Container Format**: File format that can contain other files
  - **OpenXML**: XML-based container format for Microsoft Office files
  - **VBA Project**: Contains VBA code and project information
  - **Project Stream**: Contains project information for VBA editor GUI
  - **VBA Project Stream**: Instructs the VBA engine
  - **Deere Stream**: Contains project layout for the VBA engine
  - **Modules**: Contain the actual code of macros

  ## **Manipulating File Formats**
  - **Project Stream**: Can be manipulated to remove modules from VBA editor inspection
  - **Custom UI Editor**: Allows adding custom UI parts and events to XML-based Office files
  - **Auto-Open Event**: Subroutine executed automatically when a file is opened
  - **Malware Creators**: Use custom UI to bypass auto-open-based detections

  ## **Abusing Ambiguity in Specifications**
  - **Specifications**: Complex and ambiguous, providing opportunities for exploitation
  - **ASCII and Unicode Name Fields**: Pointing to the same module tree, can be abused
  - **Must Be Ignored/Must Not Be Present**: Features often present in file formats, useful for deviation from specs
  - **OLE Tools**: Crash or show unexpected behavior when specs are deviated from

  ## **Lab Exercise: Creating a Malicious Macro**
  - **Goal**: Create a malicious macro that is invisible in the VBA editor, has no auto-open trigger, and is not parsed by OLE VBA and PicoDone
  - **Steps**:
    1. Remove auto-open event from macro
    2. Edit vbadata.xml: Rename subroutine to "auto-open" to create an auto-open event
    3. Edit vbaproject.bin: Remove reference to module 1 from project stream
    4. Mess up the compound file format of vbaproject.bin to crash OLE VBA and PicoDone

  ## **Module 2: Evasion on Dynamic Execution and Breaking Trust**
  - **Mark of the Web (MotW)**: Metadata indicating a file was downloaded from the internet, used by Microsoft Office for security checks
  - **Trusted Locations**: Locations configured in Office where files are trusted and security measures are disabled
  - **Execution Flow**: The process Office follows to check and execute macros:
    1. Check if the file originates from a trusted location
    2. Check if the file is signed by a trusted publisher
    3. Check if the file is a trusted document
  - **Code Execution Flow**: The flow of code execution when a file with macros is opened
  - **Social Engineering**: Convincing users to bypass MotW by copying files from certain locations
  - **Trusted Sites**: Sites configured in Internet Explorer, do not have the MotW flag
  - **XL4 Macros**: Legacy macros in Excel, also known as XLM, built into Excel.exe
  - **P-Code**: Pseudo-code interpreted and executed by the VBA engine
  - **Evil Clippy**: Tool for bypassing antivirus using VBA stomping and P-Code
  - **MD5**: Default hashing algorithm for macro code signing, prone to collisions

  ## **Hijacking Execution Flow of Signed Files**
  - **Assumption**: Obtaining a signed file and using it to perform attacks or lateral movement
  - **Opportunities**: Exploiting how signed files load and execute code from unsigned files
  - **Office File Loading Other Office Files**: Exploiting how Excel loads Word files, bypassing security settings
  - **VBA Code Abusing Cell Contents**: Signed VBA code relying on cell contents, which can be manipulated by attackers
  - **DLL and Declares**: Signed VBA code using external functions from DLLs, can be exploited by loading malicious DLLs
  - **XLL File Loading**: XLL (Excel add-in) loading a malicious DLL, exploiting function forwarding

  ## **Breaking Code Signing**
  - **Content Normalized Data**: Algorithm input for code signing of macros, includes project references and module stream code
  - **Project References**: Type libraries, sensitive and not properly taken into account for code signing
  - **Component Object Model (COM)**: Standard for interface communication between code components
  - **IDISPATCH Interface**: Standardized interface for late binding, used by scripting languages
  - **Early Binding**: Using type libraries to define com interfaces, improving performance
  - **Type Libraries**: Microsoft proprietary file format for defining com interfaces, can be embedded or standalone
  - **Newline Injection**: Exploitation of code signing algorithm by removing new line characters before hashing
  - **Network Type Libraries**: Type libraries loaded from network locations, now blocked by default
  - **MD5**: Default hashing algorithm for macro code signing, prone to collisions

  ## **Lateral Movement**
  - **Templates**: Using Word templates with macros on Trusted Locations for lateral movement
  - **Custom UI**: Using custom UI in Excel to reference a workbook from a Trusted Location
  - **Excel 4 Macros**: Legacy macros in Excel, built into Excel.exe and enabled via COM and DECOM
  - **Register XLL**: Method exposed by COM and DECOM for loading XML/DLL files into Excel, useful for lateral movement

  ## **Module 3: Beyond Code Execution**
  - **Fields**: Archaic Word feature for creating wizards and interfaces, useful for social engineering
  - **Protected Word File**: Using fields to create dropdown buttons and other interactive elements
  - **CVEs in Word**: Security vulnerabilities found in how Word parses fields
  - **Power of Python**: Microsoft's announcement of Python support in Excel, allowing formulas to connect to a machine running at Microsoft
  - **Power BI and Excel**: Offering features to manipulate data using M formula language, useful for reconnaissance
  - **Get Data**: Button in Excel for connecting to various data sources, including files, folders, databases, and online services
  - **Power Query M Formula**: Programming-like language for manipulating data in Power BI and Excel
  - **WebService Formula**: Allows making GET and POST requests to URLs from Excel
  - **Active Content**: Warning displayed when a file contains formulas or external data, can be enabled by the user


# ChatMessages

sender: ai
timestamp: 2024-08-17 01:39:53
message:
  Here is an expanded and elaborated version of the summary provided:

  ## **Module 1: File Format Basics**
  - **VBA (Visual Basic for Applications)**: A programming language developed by Microsoft that allows users to create custom applications within Microsoft Office applications such as Word, Excel, and PowerPoint. VBA code can be embedded within Office documents and executed when the document is opened or certain events occur.
  - **OLE (Object Linking and Embedding)**: A technology developed by Microsoft that enables the creation of compound documents by embedding or linking objects within a container document. OLE allows for the integration of different types of data, such as text, images, and spreadsheets, into a single document.
  - **OLE Tools**: A set of tools used for analyzing OLE files, such as compound files and embedded objects. These tools help in examining the structure and content of OLE files.
  - **P-Code (Pseudo-code)**: An intermediary language used by the VBA engine to interpret and execute VBA code. P-code is generated from the source code written by the developer and is executed by the VBA engine.
  - **X-Code**: Another intermediary language used by the VBA engine. It is not as commonly used as P-code and may have specific purposes or optimizations.
  - **VBA Stomping**: A technique used to manipulate VBA code to bypass antivirus (AV) detection. It involves modifying the VBA code in a way that preserves its functionality but evades detection by AV software.
  - **Mark of the Web (MotW)**: A type of metadata that indicates a file was downloaded from the internet. MotW is used by Microsoft Office as a security measure to identify potentially unsafe files.
  - **Zone Identifier**: A type of metadata stream that indicates the origin of a file. It is used by Windows to determine the security zone of a file, such as whether it was downloaded from the internet or accessed from a local network.
  - **SmartScreen**: A Windows security feature that utilizes the Zone Identifier to provide enhanced protection against potentially harmful files. SmartScreen can block or warn users about files that are flagged with MotW.
  - **Compound File**: A container format used by Microsoft Office to store multiple streams of data within a single file. It allows for the packaging of different types of data, such as text, images, and macros, into a single file.
  - **Container Format**: A file format that can contain other files or data streams. It acts as a wrapper, allowing multiple objects to be bundled together.
  - **OpenXML**: An XML-based container format introduced by Microsoft as an alternative to the traditional compound file format. OpenXML is used in newer versions of Microsoft Office and provides a more open and standardized format.
  - **VBA Project**: A collection of VBA code, project information, and settings within a Microsoft Office document. It contains the actual VBA code, along with metadata and configuration information.
  - **Project Stream**: A stream within the VBA project that contains project information used by the VBA editor GUI. It includes details such as the structure of the project, module names, and other settings.
  - **VBA Project Stream**: A stream within the VBA project that instructs the VBA engine on how to execute the VBA code. It contains instructions and metadata required by the VBA engine for proper execution.
  - **Deere Stream**: A stream within the VBA project that contains project layout information used by the VBA engine. It defines the structure and organization of the project.
  - **Modules**: Streams within the VBA project that contain the actual code of macros. These modules hold the VBA code that defines the functionality and behavior of the macros.

  ## **Manipulating File Formats**
  - **Project Stream Manipulation**: By manipulating the project stream, it is possible to remove modules from being displayed or inspected within the VBA editor. This can be used to hide malicious code from users or analysts.
  - **Custom UI Editor**: A tool provided by Microsoft that allows users to add custom UI parts and events to XML-based Office files. It enables the customization of ribbons, buttons, and other UI elements, as well as the creation of custom events.
  - **Auto-Open Event**: A subroutine that is automatically executed when a file is opened. It is a common trigger used by malware creators to initiate their malicious code.
  - **Malware Creators and Auto-Open-Based Detections**: Malware creators use the Custom UI Editor to bypass auto-open-based detections by creating custom events that trigger their malicious code instead of the default auto-open event.

  ## **Abusing Ambiguity in Specifications**
  - **Specifications**: The documentation and rules that define how Microsoft Office file formats work are complex and often ambiguous. This complexity provides opportunities for exploitation by offensive specialists.
  - **ASCII and Unicode Name Fields**: Within the specifications, there may be multiple name fields pointing to the same module tree. Offensive specialists can abuse this ambiguity to manipulate the file format and evade detection.
  - **Must Be Ignored/Must Not Be Present**: Features that are specified as "must be ignored" or "must not be present" in the specifications are often present in file formats. Offensive specialists can deviate from the specs by including or modifying these features to exploit defensive products.
  - **OLE Tools and Spec Deviation**: When offensive specialists deviate from the specifications by manipulating file formats, OLE Tools, and other defensive tools may crash or exhibit unexpected behavior. This is because these tools are designed to work with the expected file format, and any deviations can cause them to malfunction.

  ## **Lab Exercise: Creating a Malicious Macro**
  - **Goal**: The goal of the lab exercise is to create a malicious macro that achieves the following:
    1. Invisible in the VBA editor: The macro code should not be visible or accessible within the VBA editor GUI.
    2. No auto-open trigger: The macro should not have an auto-open event, which is a common detection mechanism.
    3. Not parsed by OLE VBA and PicoDone: The macro should evade detection by popular defensive tools used by analysts.
  - **Steps**:
    1. Remove auto-open event: Open the document and remove the auto-open event from the VBA code.
    2. Edit vbadata.xml: Open the vbadata.xml file, which contains VBA project information. Rename a subroutine to "auto-open" to create an auto-open event that triggers arbitrary code.
    3. Edit vbaproject.bin: Extract the vbaproject.bin file, which contains the VBA project. Open it as a compound file and remove the reference to module 1 from the project stream, effectively hiding it from the VBA editor.
    4. Mess up the compound file format: Open the modified vbaproject.bin file as a regular file and manipulate the compound file format headers to crash OLE VBA and PicoDone when they attempt to parse the file.

  ## **Module 2: Evasion on Dynamic Execution and Breaking Trust**
  - **Mark of the Web (MotW)**: Metadata added to a file indicating that it was downloaded from the internet. MotW is used by Microsoft Office to determine whether a file should be blocked or require additional user confirmation before executing macros.
  - **Trusted Locations**: Locations configured in Microsoft Office where files are considered trusted and security measures, such as macro blocking and MotW, are disabled. Files opened from trusted locations are allowed to execute macros without restrictions.
  - **Execution Flow**: The process followed by Microsoft Office when a file with macros is opened:
    1. Check if the file originates from a trusted location: If the file is from a trusted location, macros are executed.
    2. Check if the file is signed by a trusted publisher: If the file is not from a trusted location, check if it is digitally signed by a trusted publisher. If it is, macros are executed.
    3. Check if the file is a trusted document: If the file is not signed by a trusted publisher, check if it is a trusted document (previously enabled by a user). If it is, macros are executed.
  - **Code Execution Flow**: The flow of code execution when a file with macros is opened and executed. It involves the interaction between the Office application, the VBA engine, and the operating system.
  - **Social Engineering and MotW Bypass**: Convincing users to bypass MotW by copying files from certain locations or using other social engineering techniques to trick users into enabling macros.
  - **Trusted Sites**: Sites configured in Internet Explorer that do not have the MotW flag. Files downloaded from these sites do not trigger MotW, providing an opportunity for social engineering attacks.
  - **XL4 Macros (XLM)**: Legacy macros used in Excel, also known as Excel 4 Macros. XLM macros are built into Excel.exe and can be executed even if newer VBA macros are disabled.
  - **P-Code**: Pseudo-code generated by the VBA engine from the source code written by the developer. P-code is the actual code that is interpreted and executed by the VBA engine.
  - **Evil Clippy**: A tool developed by offensive specialists to bypass antivirus software using VBA stomping and P-Code manipulation techniques. It was successful in evading AV detection but has since been caught by updated AV products.
  - **MD5**: The default hashing algorithm used for macro code signing in Microsoft Office. MD5 is prone to collisions, making it insecure for cryptographic purposes.

  ## **Hijacking Execution Flow of Signed Files**
  - **Assumption**: The offensive specialists have obtained a signed file, and they want to use it to perform attacks or lateral movement within the target organization.
  - **Opportunities**: Exploiting how signed files load and execute code from unsigned files, allowing for the execution of arbitrary code.
  - **Office File Loading Other Office Files**: Exploiting how Excel loads Word files. By using a signed Excel file to load a Word file with malicious code, the security settings of the signed file are bypassed, leading to code execution.
  - **VBA Code Abusing Cell Contents**: Signed VBA code that relies on cell contents, which can be manipulated by attackers. By modifying the cell contents, attackers can execute arbitrary code or load malicious files.
  - **DLL and Declares**: Signed VBA code that uses external functions from DLLs. Offensive specialists can exploit this by loading malicious DLLs and executing arbitrary code.
  - **XLL File Loading**: XLL (Excel add-in) loading a malicious DLL. Offensive specialists can use function forwarding techniques to load their malicious DLL and execute code while also loading the original DLL to maintain the functionality of the signed file.

  ## **Breaking Code Signing**
  - **Content Normalized Data**: The algorithm input used for code signing of macros in Microsoft Office. It includes project references and module stream code, but it has several vulnerabilities that can be exploited.
  - **Project References**: Type libraries that are included in a VBA project and are sensitive from a security perspective. However, the content normalized data algorithm only takes a single byte into account, ignoring the integrity of the type libraries.
  - **Component Object Model (COM)**: A standard for interface communication between code components, allowing different programming languages to interact. COM is used by the VBA engine to locate and execute functions.
  - **IDISPATCH Interface**: A standardized interface used for late binding, commonly used by scripting languages. It allows a com client to query a com server for available interfaces and methods at runtime.
  - **Early Binding**: A technique that uses type libraries to define com interfaces, improving performance by eliminating the need for runtime queries. Type libraries provide a static definition of interfaces and methods.
  - **Type Libraries**: Microsoft proprietary file format for defining com interfaces. They can be embedded within a file or exist as standalone files. Type libraries are used by VBA to understand and interact with com servers.
  - **Newline Injection**: An exploitation technique that takes advantage of a vulnerability in the code signing algorithm. By removing new line characters before hashing, it is possible to modify the code without affecting the hash value.
  - **Network Type Libraries**: Type libraries loaded from network locations. Due to security concerns, Microsoft has blocked the loading of network type libraries by default in recent versions of Office.
  - **MD5**: The default hashing algorithm used for macro code signing, which is insecure and prone to collisions. This makes it easier for offensive specialists to manipulate the code without detection.

  ## **Lateral Movement**
  - **Templates**: Using Word templates with macros stored on Trusted Locations for lateral movement. By sending a legitimate Docx file that references a malicious template on a Trusted Location, code execution can be achieved on the target system.
  - **Custom UI**: Using custom UI in Excel to reference a workbook from a Trusted Location. This technique allows for lateral movement without relying on macros, as custom UI can be used to load malicious workbooks.
  - **Excel 4 Macros**: Legacy macros built into Excel.exe that can be executed via COM and DECOM, even if newer VBA macros are disabled. Excel 4 Macros provide an alternative method for lateral movement.
  - **Register XLL**: A method exposed by COM and DECOM that allows for the loading of XML/DLL files into Excel. Offensive specialists can use this method to achieve lateral movement by loading malicious code into Excel on a remote system.

  ## **Module 3: Beyond Code Execution**
  - **Fields**: An archaic Word feature that allows the creation of wizards and interactive interfaces within a document. Fields can be used for social engineering purposes by creating convincing and unexpected dialogues.
  - **Protected Word File**: By using fields, it is possible to create protected Word files with interactive elements such as dropdown buttons. This can enhance the credibility of a social engineering document.
  - **CVEs in Word**: Security vulnerabilities found in how Word parses and handles fields. Offensive specialists can exploit these vulnerabilities to execute code or perform other malicious actions.
  - **Power of Python**: Microsoft's announcement of Python support in Excel, allowing formulas to connect to a machine running Python code. This provides opportunities for offensive specialists to interact with external systems and potentially exfiltrate data.
  - **Power BI and Excel**: Offering features to manipulate data using the M formula language, which is similar to a programming language. Power BI and Excel can be used for reconnaissance and data exfiltration without requiring code execution.
  - **Get Data**: A button in Excel that provides access to various data sources, including files, folders, databases, and online services. It is used to connect to and import data from these sources.
  - **Power Query M Formula**: A programming-like language used by Power BI and Excel to manipulate data. It allows for complex data transformations and filtering, enabling offensive specialists to extract specific information from a target system.
  - **WebService Formula**: A formula in Excel that allows for making GET and POST requests to URLs. It can be used to interact with web services and exfiltrate data.
  - **Active Content**: A warning displayed by Excel when a file contains formulas or external data. Users can enable this content, allowing the formulas to execute and potentially exfiltrate data.

  Overall, the training session provided insights into the offensive research being conducted by Outflank in the area of Microsoft Office security. It covered a range of topics, from file format manipulation to code signing vulnerabilities and lateral movement techniques. The presenters encouraged attendees to explore and contribute to the field of Office security research, and cake and pie too.


