advanced excel hacking workshop
TRANSCRIPT
-
7/24/2019 Advanced Excel Hacking Workshop
1/41
Advanced Excel Hacking Workshop
Didier Stevens
http://.DidierStevens.com/excel.zip
-
7/24/2019 Advanced Excel Hacking Workshop
2/41
No Exploits
Just Features
-
7/24/2019 Advanced Excel Hacking Workshop
3/41
Unzip excel.zip to c:\excel
Passord: !or"shop
http://c/excelhttp://c/excel -
7/24/2019 Advanced Excel Hacking Workshop
4/41
#$% isual $asic 'or %pplications(
is a complete !indos pro)rammin) lan)ua)e
-
7/24/2019 Advanced Excel Hacking Workshop
5/41
#$S isual $asic Script(
is N*+ a complete !indos pro)rammin)lan)ua)e
-
7/24/2019 Advanced Excel Hacking Workshop
6/41
#$% has access to the !indos %P,
-
7/24/2019 Advanced Excel Hacking Workshop
7/41
#$%: -S *''ice &!ord Excel Poerpoint (%uto0%D ...
-
7/24/2019 Advanced Excel Hacking Workshop
8/41
Excel: hat , pre'er as a User ,nter'ace
-
7/24/2019 Advanced Excel Hacking Workshop
9/41
-
7/24/2019 Advanced Excel Hacking Workshop
10/41
-
7/24/2019 Advanced Excel Hacking Workshop
11/41
Exercise 1:
23ello !orld4 messa)e 5ox ith #$%
-
7/24/2019 Advanced Excel Hacking Workshop
12/41
#$%6
,ntroduced ith *''ice 7818
Support 'or 9;5it
-
7/24/2019 Advanced Excel Hacking Workshop
13/41
-
7/24/2019 Advanced Excel Hacking Workshop
14/41
Excel 7886 or earlier:
-
7/24/2019 Advanced Excel Hacking Workshop
15/41
Excel 7818 or 781
-
7/24/2019 Advanced Excel Hacking Workshop
16/41
-
7/24/2019 Advanced Excel Hacking Workshop
17/41
< ne #$%6 "e>ords:
PtrSa'e?on)?on)?on)Ptr
-
7/24/2019 Advanced Excel Hacking Workshop
18/41
7 ne #$%6 compilation constants
#$%6!in9
-
7/24/2019 Advanced Excel Hacking Workshop
19/41
, use !in9
,' !in9 is de'ined , "no that ,@m usin) #$%6 on
a 9;5it application
+hus , use the ne "e>ords&PtrSa'e ?on)?on) ?on)Ptr(
-
7/24/2019 Advanced Excel Hacking Workshop
20/41
,' !in9 is not de'ined , "no that , am on
-
7/24/2019 Advanced Excel Hacking Workshop
21/41
Exercise 7:
23ello !orld4 messa)e 5ox ith %P,
-
7/24/2019 Advanced Excel Hacking Workshop
22/41
%P, 'unctions:
not onl> 5asic t>pes as ar)uments
5ut also structures
-
7/24/2019 Advanced Excel Hacking Workshop
23/41
Private Declare PtrSa'e Su5 BetS>stem+ime ?i5
C"ernel
-
7/24/2019 Advanced Excel Hacking Workshop
24/41
Private +>pe SS+E-+,-E
ear %s ,nte)er -onth %s ,nte)er Da>*'!ee" %s ,nte)er Da> %s ,nte)er
3our %s ,nte)er -inute %s ,nte)er Second %s ,nte)er -illiseconds %s ,nte)erEnd +>pe
-
7/24/2019 Advanced Excel Hacking Workshop
25/41
Exercise stem+ime
-
7/24/2019 Advanced Excel Hacking Workshop
26/41
,nstalledPro)rams
-
7/24/2019 Advanced Excel Hacking Workshop
27/41
Netor"-ashup;
-
7/24/2019 Advanced Excel Hacking Workshop
28/41
+as"-ana)er.xls / +as"-ana)erS0.xls
-
7/24/2019 Advanced Excel Hacking Workshop
29/41
Pro5lem: ritin) a lot o' #$% code
-
7/24/2019 Advanced Excel Hacking Workshop
30/41
Datapipe
-
7/24/2019 Advanced Excel Hacking Workshop
31/41
-odi'> 0 source code datapipe
datapipe.exe datapipe.dll
-
7/24/2019 Advanced Excel Hacking Workshop
32/41
-
7/24/2019 Advanced Excel Hacking Workshop
33/41
-
7/24/2019 Advanced Excel Hacking Workshop
34/41
D?? to shellcode
0reate-emor>-oduleShell0ode.p> datapipe;dll.dll datapipe;dll.dll.5in
-
7/24/2019 Advanced Excel Hacking Workshop
35/41
Shellcode to #$%
shellcode7v5a.p> datapipe;dll.dll.5in datapipe;dll.dll.5in.5ase9.v5a
-
7/24/2019 Advanced Excel Hacking Workshop
36/41
eact*S cmd and re)edit
-
7/24/2019 Advanced Excel Hacking Workshop
37/41
-
7/24/2019 Advanced Excel Hacking Workshop
38/41
-
7/24/2019 Advanced Excel Hacking Workshop
39/41
-
7/24/2019 Advanced Excel Hacking Workshop
40/41
Putt>
-
7/24/2019 Advanced Excel Hacking Workshop
41/41
78G discount sale 'or $rucon:
PDF %nal>sis or"shop videos on 0D: H78
!hite 3at Shellcode or"shop videos on 0D: H78
x9 or"shop videos on 0D: H78
%ll videos on 0D: HI8
http://DidierStevens?a5s.com