Advanced Excel Hacking Workshop - BruCON...
Transcript of Advanced Excel Hacking Workshop - BruCON...
![Page 1: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/1.jpg)
Advanced Excel Hacking Workshop
Didier Stevens
http://.DidierStevens.com/excel.zip
![Page 2: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/2.jpg)
No Exploits
Just Features
![Page 3: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/3.jpg)
Unzip excel.zip to c:\excel
Password: Workshop
![Page 4: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/4.jpg)
VBA (Visual Basic for Applications)
is a complete Windows programming language
![Page 5: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/5.jpg)
VBS (Visual Basic Script)
is NOT a complete Windows programming language
![Page 6: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/6.jpg)
VBA has access to the Windows API
![Page 7: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/7.jpg)
VBA: MS Office (Word, Excel Powerpoint, …), AutoCAD, ...
![Page 8: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/8.jpg)
Excel: what I prefer as a User Interface
![Page 9: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/9.jpg)
![Page 10: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/10.jpg)
![Page 11: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/11.jpg)
Exercise 1:
“Hello World” message box with VBA
![Page 12: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/12.jpg)
VBA7
Introduced with Office 2010
Support for 64-bit
![Page 13: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/13.jpg)
32-bit Excel or 64-bit Excel?
![Page 14: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/14.jpg)
Excel 2007 or earlier: 32-bit
![Page 15: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/15.jpg)
Excel 2010 or 2013:
Check File/Help
![Page 16: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/16.jpg)
![Page 17: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/17.jpg)
3 new VBA7 keywords:
PtrSafeLongLongLongPtr
![Page 18: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/18.jpg)
2 new VBA7 compilation constants
VBA7Win64
![Page 19: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/19.jpg)
I use Win64
If Win64 is defined, I know that I'm using VBA7 on a 64-bit application
Thus I use the new keywords(PtrSafe, LongLong, LongPtr)
![Page 20: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/20.jpg)
If Win64 is not defined, I know that I am on 32-bit application.
And then I DO NOT use the new keywords.
![Page 21: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/21.jpg)
Exercise 2:
“Hello World” message box with API
32-bit, 64-bit & both
![Page 22: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/22.jpg)
API functions:
not only basic types as arguments,
but also structures
![Page 23: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/23.jpg)
Private Declare PtrSafe Sub GetSystemTime Lib "kernel32.dll" (st As SYSTEMTIME)
![Page 24: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/24.jpg)
Private Type SYSTEMTIME wYear As Integer wMonth As Integer wDayOfWeek As Integer wDay As Integer wHour As Integer wMinute As Integer wSecond As Integer wMilliseconds As IntegerEnd Type
![Page 25: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/25.jpg)
Exercise 3:
GetSystemTime
32-bit, 64-bit & both
![Page 26: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/26.jpg)
InstalledPrograms
![Page 27: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/27.jpg)
NetworkMashup-32
![Page 28: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/28.jpg)
TaskManager.xls / TaskManagerSC.xls
![Page 29: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/29.jpg)
Problem: writing a lot of VBA code
![Page 30: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/30.jpg)
Datapipe
![Page 31: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/31.jpg)
Modify C source code datapipe
datapipe.exe → datapipe.dll
![Page 32: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/32.jpg)
![Page 33: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/33.jpg)
![Page 34: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/34.jpg)
DLL to shellcode
CreateMemoryModuleShellCode.py datapipe-dll.dll datapipe-dll.dll.bin
![Page 35: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/35.jpg)
Shellcode to VBA
shellcode2vba.py datapipe-dll.dll.bin datapipe-dll.dll.bin.base64.vba
![Page 36: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/36.jpg)
ReactOS cmd and regedit
![Page 37: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/37.jpg)
![Page 38: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/38.jpg)
![Page 39: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/39.jpg)
![Page 40: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/40.jpg)
Putty
![Page 41: Advanced Excel Hacking Workshop - BruCON 2017files.brucon.org/2013/advanced-excel-hacking-workshop.pdf · 2013-10-02 · I use Win64 If Win64 is defined, I know that I'm using VBA7](https://reader034.fdocuments.in/reader034/viewer/2022042118/5e966a8d7f2fe71d8d18d9bc/html5/thumbnails/41.jpg)
20% discount sale for Brucon:
PDF Analysis workshop videos on CD: €20
White Hat Shellcode workshop videos on CD: €20
x64 workshop videos on CD: €20
All videos on CD: €50
http://DidierStevensLabs.com