Generates Malicious Macro and Execute Powershell or Shellcode via MSBuild Application Whitelisting Bypass, this tool intended for adversary simulation and red teaming purpose.
MaliciousMacroMSBuild should be used for authorized red teaming and/or nonprofit educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.
Version 2.1
-----------
+ Added sandbox evasion technique using environmental keying domain checking
+ Added Kill Date format dd/mm/yyyy [28/02/2018]
+ Move payload from public user to current user download folder
Version 2.0
-----------
+ Added Option Macro AMSI Bypass (Thanks to outflank team)
+ Added PPID Spoofing {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
+ Added functionality auto removed csproj payload after execution
+ Added custom msbuild option
/$$ /$$ /$$$$$$ /$$$$$$
| $$$ /$$$ /$$__ $$ /$$__ $$
| $$$$ /$$$$|__/ \ $$| $$ \__/
| $$ $$/$$ $$ /$$$$$/| $$ /$$$$
| $$ $$$| $$ |___ $$| $$|_ $$
| $$\ $ | $$ /$$ \ $$| $$ \ $$
| $$ \/ | $$| $$$$$$/| $$$$$$/
|__/ |__/ \______/ \______/
Malicious Macro MSBuild Generator v2.1
Author : Rahmat Nurfauzi (@infosecn1nja)
usage: m3-gen.py [-h] -i INPUTFILE -p PAYLOAD -o OUTPUT [-a] [-d DOMAIN]
[-k KILL_DATE]
optional arguments:
-h, --help show this help message and exit
-i INPUTFILE, --inputfile INPUTFILE
Input file you want to embed into the macro
-p PAYLOAD, --payload PAYLOAD
Choose a payload for powershell, raw shellcode or custom
-o OUTPUT, --output OUTPUT
Output filename for the macro
-a, --amsi_bypass Macro AMSI Bypass Execute via ms office trusted location
-d DOMAIN, --domain DOMAIN
Sandbox evasion technique using environmental keying domain checking. Use comma separating to set multiple domains
-k KILL_DATE, --kill_date KILL_DATE
Set kill date format dd/MM/yyyy the payload do not run on or after this day
- Choose a payload you want to test like shellcode or powershell, the shellcode support stageless and staged payload
- Generate a raw shellcode in whatever framework you want (Cobalt Strike, Empire, PoshC2)
python m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba
python m3-gen.py -p powershell -i /path/payload.ps1 -o output.vba
python m3-gen.py -p custom -i /path/msbuild.xml -o output.vba
python m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba -k 20/03/2018
python m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba -d yourdomainpython m3-gen.py -p shellcode -i /path/beacon.bin -o output.vba -d yourdomain, microsoft, github
- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
- https://attack.mitre.org/techniques/T1127/
- https://msdn.microsoft.com/en-us/library/dd722601.aspx
Author : Rahmat Nurfauzi - @infosecn1nja
Credits : @subTee - For discovering msbuild technique
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent