Transcript
7/24/2019 Advanced Excel Hacking Workshop
1/41
Advanced Excel Hacking Workshop
Didier Stevens
http://.DidierStevens.com/excel.zip
7/24/2019 Advanced Excel Hacking Workshop
2/41
No Exploits
Just Features
7/24/2019 Advanced Excel Hacking Workshop
3/41
Unzip excel.zip to c:\excel
Passord: !or"shop
http://c/excelhttp://c/excel7/24/2019 Advanced Excel Hacking Workshop
4/41
#$% isual $asic 'or %pplications(
is a complete !indos pro)rammin) lan)ua)e
7/24/2019 Advanced Excel Hacking Workshop
5/41
#$S isual $asic Script(
is N*+ a complete !indos pro)rammin)lan)ua)e
7/24/2019 Advanced Excel Hacking Workshop
6/41
#$% has access to the !indos %P,
7/24/2019 Advanced Excel Hacking Workshop
7/41
#$%: -S *''ice &!ord Excel Poerpoint (%uto0%D ...
7/24/2019 Advanced Excel Hacking Workshop
8/41
Excel: hat , pre'er as a User ,nter'ace
7/24/2019 Advanced Excel Hacking Workshop
9/41
7/24/2019 Advanced Excel Hacking Workshop
10/41
7/24/2019 Advanced Excel Hacking Workshop
11/41
Exercise 1:
23ello !orld4 messa)e 5ox ith #$%
7/24/2019 Advanced Excel Hacking Workshop
12/41
#$%6
,ntroduced ith *''ice 7818
Support 'or 9;5it
7/24/2019 Advanced Excel Hacking Workshop
13/41
7/24/2019 Advanced Excel Hacking Workshop
14/41
Excel 7886 or earlier:
7/24/2019 Advanced Excel Hacking Workshop
15/41
Excel 7818 or 781
7/24/2019 Advanced Excel Hacking Workshop
16/41
7/24/2019 Advanced Excel Hacking Workshop
17/41
< ne #$%6 "e>ords:
PtrSa'e?on)?on)?on)Ptr
7/24/2019 Advanced Excel Hacking Workshop
18/41
7 ne #$%6 compilation constants
#$%6!in9
7/24/2019 Advanced Excel Hacking Workshop
19/41
, use !in9
,' !in9 is de'ined , "no that ,@m usin) #$%6 on
a 9;5it application
+hus , use the ne "e>ords&PtrSa'e ?on)?on) ?on)Ptr(
7/24/2019 Advanced Excel Hacking Workshop
20/41
,' !in9 is not de'ined , "no that , am on
7/24/2019 Advanced Excel Hacking Workshop
21/41
Exercise 7:
23ello !orld4 messa)e 5ox ith %P,
7/24/2019 Advanced Excel Hacking Workshop
22/41
%P, 'unctions:
not onl> 5asic t>pes as ar)uments
5ut also structures
7/24/2019 Advanced Excel Hacking Workshop
23/41
Private Declare PtrSa'e Su5 BetS>stem+ime ?i5
C"ernel
7/24/2019 Advanced Excel Hacking Workshop
24/41
Private +>pe SS+E-+,-E
ear %s ,nte)er -onth %s ,nte)er Da>*'!ee" %s ,nte)er Da> %s ,nte)er
3our %s ,nte)er -inute %s ,nte)er Second %s ,nte)er -illiseconds %s ,nte)erEnd +>pe
7/24/2019 Advanced Excel Hacking Workshop
25/41
Exercise stem+ime
7/24/2019 Advanced Excel Hacking Workshop
26/41
,nstalledPro)rams
7/24/2019 Advanced Excel Hacking Workshop
27/41
Netor"-ashup;
7/24/2019 Advanced Excel Hacking Workshop
28/41
+as"-ana)er.xls / +as"-ana)erS0.xls
7/24/2019 Advanced Excel Hacking Workshop
29/41
Pro5lem: ritin) a lot o' #$% code
7/24/2019 Advanced Excel Hacking Workshop
30/41
Datapipe
7/24/2019 Advanced Excel Hacking Workshop
31/41
-odi'> 0 source code datapipe
datapipe.exe datapipe.dll
7/24/2019 Advanced Excel Hacking Workshop
32/41
7/24/2019 Advanced Excel Hacking Workshop
33/41
7/24/2019 Advanced Excel Hacking Workshop
34/41
D?? to shellcode
0reate-emor>-oduleShell0ode.p> datapipe;dll.dll datapipe;dll.dll.5in
7/24/2019 Advanced Excel Hacking Workshop
35/41
Shellcode to #$%
shellcode7v5a.p> datapipe;dll.dll.5in datapipe;dll.dll.5in.5ase9.v5a
7/24/2019 Advanced Excel Hacking Workshop
36/41
eact*S cmd and re)edit
7/24/2019 Advanced Excel Hacking Workshop
37/41
7/24/2019 Advanced Excel Hacking Workshop
38/41
7/24/2019 Advanced Excel Hacking Workshop
39/41
7/24/2019 Advanced Excel Hacking Workshop
40/41
Putt>
7/24/2019 Advanced Excel Hacking Workshop
41/41
78G discount sale 'or $rucon:
PDF %nal>sis or"shop videos on 0D: H78
!hite 3at Shellcode or"shop videos on 0D: H78
x9 or"shop videos on 0D: H78
%ll videos on 0D: HI8
http://DidierStevens?a5s.com
top related