Skip to content

Proof of concept VBA code to add to Normal.dot to put restrictions on Word

Notifications You must be signed in to change notification settings

JohnLaTwC/MacroJob

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

8 Commits
 
 
 
 

Repository files navigation

MacroJob

Proof-of-concept by @JohnLaTwC December 2016 This is for learning purposes only. It is not secure. It is not complete. It is provided as a way to learn about Windows Security mechanisms.

Macro malware was all the rage in the 1990s (just ask @VessOnSecurity) and now they are back with a vengeance (https://twitter.com/JohnLaTwC/status/775689864389931008). So it is only appropriate to use 1990s technology to fight 1990s threats.

The idea here is that most malicious Word macro files lure the user to 'Enable Content' or 'Enable Macros' and then launch another program in the background to run a payload. By blocking the ability for Word to launch other processes, many commodity malware samples will fail.

This proof-of-concept calls the Win32 APIs for Windows Job Objects. Job objects were introduced in Windows 2000. Here is an article from 1999 by Jeffrey Richter on them: https://www.microsoft.com/msj/0399/jobkernelobj/jobkernelobj.aspx

Job objects allow you to place many different restrictions on processes. This poc uses the JOB_OBJECT_LIMIT_ACTIVE_PROCESS option to limit child processes. You can learn more about job objects here: https://msdn.microsoft.com/en-us/library/windows/desktop/ms684161(v=vs.85).aspx

Channel your inner @tiraniddo to learn about Windows security primitives and figure out how to bypass them, then develop a countermeasure :)

INSTALL:

  1. Launch Word, New Blank Document
  2. From the View ribbon tab, click Macros (Alt + F8)
  3. Select Normal.dotm (global template) from 'Macros in:' combobox
  4. Type 'test' as the macro name and click Create. This will bring up the VBA editor
  5. Paste in these macros.
  6. Save and exit Word

About

Proof of concept VBA code to add to Normal.dot to put restrictions on Word

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published