EvilClippy - A cross-platform assistant for creating malicious

项目说明

This tool was released during our BlackHat Asia talk (March 28, 2019). A video recording of this talk is a at

E

A cross-platform assistant for creating malicious MS Office documents. Can hide , stomp VBA code () and confuse macro analysis tools. Runs on Linux, OSX and Windows.

If you're new to this tool, you might want to start by reading our blog post on E:

This project should be used for authorized testing or educational purposes only.

Current features

* Hide from the GUI editor
* (P-code abuse)
* Fool analyst tools
* Serve templates via HTTP
* Set/Remove Locked/Un Protection

If you have no idea what all of this is, check out the following resources first:
* Our MS Office Magic Show presentation at Derbycon 2018
* resources by the Walmart security team
* Pcodedmp by Dr. Bontchev

How effective is this?

At the time of writing, this tool is capable of getting a default Cobalt Strike macro to bypass most major antivirus products and maldoc analysis tools (by using in combination with random module names).

Technology

E uses the OpenMCDF library to manipulate MS Office Compound File Binary Format (CFBF) files, and hereto abuses MS-O and features. It reuses code from Kavod. to implement the compression algorithm that is used in dir and module streams (see MS-OVBA for relevant specifications).

E compiles perfectly fine with the Mono C# compiler and has been tested on Linux, OSX and Windows.

Compilation

We do not provide a binary release for E. Please compile executables yourself:

OSX and Linux

Make sure you have Mono installed. Then execute the following command from the command line:

mcs /reference:OpenMcdf.dll,System.IO.Compression.FileSystem.dll /out:E.exe *.cs

Now run E from the command line:

mono E.exe -h

Windows

Make sure you ha Studio installed. Then execute the following command from a Studio de command prompt:

csc /reference:OpenMcdf.dll,System.IO.Compression.FileSystem.dll /out:E.exe *.cs

Now run E from the command line:

E.exe -h

Usage examples

Print help

E.exe -h

Hide/Unhide macros from GUI

Hide all macro modules (except the default "ThisDocument" module) from the VBA GUI editor. This is achieved by removing module lines from the project stream [MS-OVBA 2.3.1].

E.exe -g macrofile.doc

Undo the changes done by the hide option (-g) so that we can debug the macro in the VBA IDE.

E.exe -gg macrofile.doc

Stomp VBA (abuse P-code)

Put fake VBA code from text file *fakecode.vba* in all modules, while leaving P-code intact. This abuses an undocumented feature of module streams [MS-OVBA 2.3.4.3]. Note that the must match the host program in order for the P-code to be executed (see next example for matching).

E.exe -s fakecode..doc

Note: does not work for files saved in the Excel 97-2003 Workbook (.xls) format

Set target Office for

Same as the above, but now explicitly targeting Word 2016 on x86. This means that Word 2016 on x86 will execute the P-code, while other of Word wil execute the code from *fakecode.vba* instead. Achieved by setting the appropriate bytes in the _ stream [MS-OVBA 2.3.4.1].

E.exe -s fakecode.vba -t 2016x86 macrofile.doc

Set/reset random module names (fool analyst tools)

Set random ASCII module names in the dir stream [MS-OVBA 2.3.4.2]. This abuses ambiguity in the MODULESTREAMNAME records [MS-OVBA 2.3.4.2.3.2.3] - most analyst tools use the ASCII module names specified here, while MS Office used the Unicode . By setting a random ASCII module name most P-code and tools crash, while the actual P-code and runs fine in Word and Excel.

E.exe -r macrofile.doc

Note: this is known to be effective in tricking pcodedmp and

Set ASCII module names in the dir stream to match their Unicode counterparts. This re the changes made using the (-r) optoin of E

E.exe -rr macrofile.doc

Serve a template via HTTP

Service *macrofile.dot* via HTTP port 8080 after performing . If this file is retrieved, it automatically matches the target's Office (using its HTTP headers and then setting the _ bytes accordingly).

E.exe -s fakecode.vba -w 8080 macrofile.dot

Note: The file you are serving must be a template (.dot instead of .doc). You can set a template via a URL (.dot extension is not required!) from the de toolbar in Word. Also, fakecode.vba must have a attribute set for a macro from a template (this means that your fakecode.vba must start with a line such as *Attribute = "0{00020906-0000-0000-C000-000000000046}"*).

Set/Remove Locked/Un Protection

To set the Locked/Un attributes use the '-u' option:

E.exe -u macrofile.doc

To remove the Locked/Un attributes use the '-uu' option:

E.exe -uu macrofile.doc

Note: You can remove the Locked/Un attributes on files that were not locked with E as well.

Limitations

De for Microsoft Word and Excel document manipulation.

As noted above, is not effecti Excel 97-2003 Workbook (.xls) format.

Authors

Stan Hegt () / Outflank

With significant contributions by Carrie Roberts ( / Walmart).

Special thanks to Nick Landers ( / Silent Break Security) for pointing me towards OpenMCDF.

项目信息

开发语言：C#

Star 数：2259

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。