启用宏的文档是包含宏的文档，宏是自动执行任务的指令集。宏可以用Visual Basic for Applications (VBA)编写，可用于执行各种任务，例如格式化文本、执行计算和自动执行复杂的过程。然而，攻击者经常利用Office文档的这一功能进行网络钓鱼攻击，并嵌入恶意宏来执行恶意操作并在系统上安装恶意软件。
oleid Hello.docm oleid 0.60.1 - http://decalage.info/oletools THIS IS WORK IN PROGRESS - Check updates regularly! Please report any issue at https://github.com/decalage2/oletools/issues
Filename: Hello.docm WARNING For now, VBA stomping cannot be detected for files in memory --------------------+--------------------+----------+-------------------------- Indicator |Value |Risk |Description --------------------+--------------------+----------+-------------------------- File format |MS Word 2007+ Macro-|info | |Enabled Document | | |(.docm) | | --------------------+--------------------+----------+-------------------------- Container format |OpenXML |info |Container type --------------------+--------------------+----------+-------------------------- Encrypted |False |none |The file is not encrypted --------------------+--------------------+----------+-------------------------- VBA Macros |Yes |Medium |This file contains VBA | | |macros. No suspicious | | |keyword was found. Use | | |olevba and mraptor for | | |more info. --------------------+--------------------+----------+-------------------------- XLM Macros |No |none |This file does not contain | | |Excel 4/XLM macros. --------------------+--------------------+----------+-------------------------- External |0 |none |External relationships Relationships | | |such as remote templates, | | |remote OLE objects, etc --------------------+--------------------+----------+--------------------------
$ zsteg starry_night.png imagedata .. file: byte-swapped Berkeley vfont data b1,rgb,lsb,xy .. text: "148:The fishermen know that the sea is dangerous and the storm terrible, but they have never found these dangers sufficient reason for remaining ashore.*" b2,b,msb,xy .. file: OpenPGP Public Key b2,bgr,lsb,xy .. text: "[\t7J(BY*" b2,bgr,msb,xy .. file: RLE image data, 3654 x -30514, lower left corner: 2428, lower right corner: 17057, clear first, 86 color channels b3,r,lsb,xy .. text: "BH<P9nYT~" b4,b,lsb,xy .. file: OpenPGP Secret Key b4,bgr,lsb,xy .. file: OpenPGP Secret Key
$ oleid YearlyBonus.docm oleid 0.60.1 - http://decalage.info/oletools THIS IS WORK IN PROGRESS - Check updates regularly! Please report any issue at https://github.com/decalage2/oletools/issues
Filename: YearlyBonus.docm WARNING For now, VBA stomping cannot be detected for files in memory --------------------+--------------------+----------+-------------------------- Indicator |Value |Risk |Description --------------------+--------------------+----------+-------------------------- File format |MS Word 2007+ Macro-|info | |Enabled Document | | |(.docm) | | --------------------+--------------------+----------+-------------------------- Container format |OpenXML |info |Container type --------------------+--------------------+----------+-------------------------- Encrypted |False |none |The file is not encrypted --------------------+--------------------+----------+-------------------------- VBA Macros |Yes, suspicious |HIGH |This file contains VBA | | |macros. Suspicious | | |keywords were found. Use | | |olevba and mraptor for | | |more info. --------------------+--------------------+----------+-------------------------- XLM Macros |No |none |This file does not contain | | |Excel 4/XLM macros. --------------------+--------------------+----------+-------------------------- External |0 |none |External relationships Relationships | | |such as remote templates, | | |remote OLE objects, etc --------------------+--------------------+----------+--------------------------
Dim str As String str = "You have been hacked!" MsgBox str Call doShenanigans
End Sub +----------+--------------------+---------------------------------------------+ |Type |Keyword |Description | +----------+--------------------+---------------------------------------------+ |AutoExec |AutoOpen |Runs when the Word document is opened | |Suspicious|Call |May call a DLL using Excel 4 Macros (XLM/XLF)| +----------+--------------------+---------------------------------------------+
宏代码提取出来之后，我们尝试新建一个docm文件，输出内容：
1
Oh, and almost forgot, here's something little cryptic for you: Php%rhnk^ZeerdghprhnkpZrZkhng]ZO;:fZ\kh\aZee^g`^'Rhnk_eZ`bl3_eZ`tln\aXf-\k)Xfn\aXp)pv
$ exiftool image1.jpg ExifTool Version Number : 12.40 File Name : image1.jpg Directory : . File Size : 46 KiB File Modification Date/Time : 2023:02:09 05:36:55+08:00 File Access Date/Time : 2024:04:02 14:50:07+08:00 File Inode Change Date/Time : 2024:04:02 14:49:56+08:00 File Permissions : -rw------- File Type : JPEG File Type Extension : jpg MIME Type : image/jpeg JFIF Version : 1.01 Exif Byte Order : Big-endian (Motorola, MM) X Resolution : 1 Y Resolution : 1 Resolution Unit : None Artist : Michael Scott Y Cb Cr Positioning : Centered GPS Version ID : 2.3.0.0 GPS Latitude : 34 deg 12' 39.33" GPS Longitude : 118 deg 26' 11.15" Image Width : 800 Image Height : 450 Encoding Process : Baseline DCT, Huffman coding Bits Per Sample : 8 Color Components : 3 Y Cb Cr Sub Sampling : YCbCr4:4:4 (1 1) Image Size : 800x450 Megapixels : 0.360 GPS Position : 34 deg 12' 39.33", 118 deg 26' 11.15" $ steghide info image1.jpg "image1.jpg": format: jpeg capacity: 2.6 KB Try to get information about embedded data ? (y/n) y Enter passphrase: embedded file "top_secret.txt": size: 226.0 Byte encrypted: rijndael-128, cbc compressed: yes $ cat top_secret.txt I have obtained information regarding a top secret mission. The details are highly classified and must not fall into the wrong hands. Proceed with caution and use extreme discretion in all communications regarding this matter.
