Sevagas

RedTeam With OneNote

Emeric Nasi — 2022-08-09T15:07:32Z

OneNote is one of the Office suite components which is often overlooked when RedTeaming. Though OneNote cannot execute VBA Macros, it has an important potential for phishing as an initial vector.

- MacroPack

RedTeam With Publisher

Emeric Nasi — 2022-04-28T16:22:31Z

Microsoft Publisher is another tool of the Office suite which is often ignored when RedTeaming. This is a basic review of the great potential Publisher has for Offensive Security engagements.

- MacroPack

MSDT DLL Hijack UAC bypass

Emeric Nasi — 2022-02-02T15:23:54Z

UAC Bypass via DLL hijacking of Microsoft Support Diagnostic Tool (MSDT). The UAC bypass method described here is based on DLL hijacking which happens when loading the Bluetooth diagnostic package.

- Windows

Hide HTA window for RedTeam

Emeric Nasi — 2021-07-15T18:14:19Z

Short post to explain how to create a stealthy HTA file running without any window or taskbar mention. This can be used combined withe other techniques to create advanced payloads for redteaming/supply chain attacks.

- Windows

Launch shellcodes and bypass Antivirus using MacroPack Pro VBA payloads

Emeric Nasi — 2021-01-21T18:11:52Z

If you have ever been frustrated with manually writing Office/VBS payloads that ends up being detected by antivirus read this post!
MacroPack Pro provides multiple options and templates related to shellcode launch, these options enable to build VBA code which is not detected by most security solutions.
Let me show you how MacroPack Pro automatically generates Office, HTA, shortcut, etc. shellcode launcher payloads which bypass security solutions.

- MacroPack

Advanced MacroPack payloads: XLM Injection

Emeric Nasi — 2020-09-18T16:28:06Z

How it is possible to inject and run Excel 4.0 macro in memory from a non Excel format payload (ex Word, HTA, Help files,...). How to generate using MacroPack Pro.

- MacroPack

EXCEL 4.0 XLM macro in MacroPack Pro

Emeric Nasi — 2020-09-18T16:26:56Z

Excel 4.0 macro (also called XLM) have been commonly used by malicious operators these last years, it has also been analyzed and commented by several researches (red or blue). So I decided to add the support of this language for MacroPack Pro.

- MacroPack

Code Injection - Weaponize GhostWriting Injection

Emeric Nasi — 2020-09-02T16:24:08Z

Lets talk about this code injection technique called GhostWriting that works by manipulating the register states of the target process thread.

- Code injection series

Bypass Defender and other thoughts on Unicode RTLO attacks

Emeric Nasi — 2020-05-25T19:00:19Z

I have been looking a bit into Unicode and Right-To-Left-Override phishing attacks lately. Mainly because I noticed that Windows Defender was detecting payloads generated with the "—unicode-rtlo" options of MacroPack...

- Miscellaneous

Code Injection - Disable Dynamic Code Mitigation (ACG)

Emeric Nasi — 2019-12-01T21:00:05Z

How to disable Dynamic Code Mitigation Policy (ACG) to be able to inject code and deploy hooks into Microsoft Edge and others

- Code injection series