7/24/2019 Advanced Excel Hacking Workshop

1/41

Advanced Excel Hacking Workshop

Didier Stevens

http://.DidierStevens.com/excel.zip

7/24/2019 Advanced Excel Hacking Workshop

2/41

No Exploits

Just Features

7/24/2019 Advanced Excel Hacking Workshop

3/41

Unzip excel.zip to c:\excel

Passord: !or"shop

http://c/excelhttp://c/excel

7/24/2019 Advanced Excel Hacking Workshop

4/41

#$% isual $asic 'or %pplications(

is a complete !indos pro)rammin) lan)ua)e

7/24/2019 Advanced Excel Hacking Workshop

5/41

#$S isual $asic Script(

is N*+ a complete !indos pro)rammin)lan)ua)e

7/24/2019 Advanced Excel Hacking Workshop

6/41

#$% has access to the !indos %P,

7/24/2019 Advanced Excel Hacking Workshop

7/41

#$%: -S *''ice &!ord Excel Poerpoint (%uto0%D ...

7/24/2019 Advanced Excel Hacking Workshop

8/41

Excel: hat , pre'er as a User ,nter'ace

7/24/2019 Advanced Excel Hacking Workshop

9/41

7/24/2019 Advanced Excel Hacking Workshop

10/41

7/24/2019 Advanced Excel Hacking Workshop

11/41

Exercise 1:

23ello !orld4 messa)e 5ox ith #$%

7/24/2019 Advanced Excel Hacking Workshop

12/41

#$%6

,ntroduced ith *''ice 7818

Support 'or 9;5it

7/24/2019 Advanced Excel Hacking Workshop

13/41

7/24/2019 Advanced Excel Hacking Workshop

14/41

Excel 7886 or earlier:

7/24/2019 Advanced Excel Hacking Workshop

15/41

Excel 7818 or 781

7/24/2019 Advanced Excel Hacking Workshop

16/41

7/24/2019 Advanced Excel Hacking Workshop

17/41

< ne #$%6 "e>ords:

PtrSa'e?on)?on)?on)Ptr

7/24/2019 Advanced Excel Hacking Workshop

18/41

7 ne #$%6 compilation constants

#$%6!in9

7/24/2019 Advanced Excel Hacking Workshop

19/41

, use !in9

,' !in9 is de'ined , "no that ,@m usin) #$%6 on

a 9;5it application

+hus , use the ne "e>ords&PtrSa'e ?on)?on) ?on)Ptr(

7/24/2019 Advanced Excel Hacking Workshop

20/41

,' !in9 is not de'ined , "no that , am on

7/24/2019 Advanced Excel Hacking Workshop

21/41

Exercise 7:

23ello !orld4 messa)e 5ox ith %P,

7/24/2019 Advanced Excel Hacking Workshop

22/41

%P, 'unctions:

not onl> 5asic t>pes as ar)uments

5ut also structures

7/24/2019 Advanced Excel Hacking Workshop

23/41

Private Declare PtrSa'e Su5 BetS>stem+ime ?i5

C"ernel

7/24/2019 Advanced Excel Hacking Workshop

24/41

Private +>pe SS+E-+,-E

ear %s ,nte)er -onth %s ,nte)er Da>*'!ee" %s ,nte)er Da> %s ,nte)er

3our %s ,nte)er -inute %s ,nte)er Second %s ,nte)er -illiseconds %s ,nte)erEnd +>pe

7/24/2019 Advanced Excel Hacking Workshop

25/41

Exercise stem+ime

7/24/2019 Advanced Excel Hacking Workshop

26/41

,nstalledPro)rams

7/24/2019 Advanced Excel Hacking Workshop

27/41

Netor"-ashup;

7/24/2019 Advanced Excel Hacking Workshop

28/41

+as"-ana)er.xls / +as"-ana)erS0.xls

7/24/2019 Advanced Excel Hacking Workshop

29/41

Pro5lem: ritin) a lot o' #$% code

7/24/2019 Advanced Excel Hacking Workshop

30/41

Datapipe

7/24/2019 Advanced Excel Hacking Workshop

31/41

-odi'> 0 source code datapipe

datapipe.exe datapipe.dll

7/24/2019 Advanced Excel Hacking Workshop

32/41

7/24/2019 Advanced Excel Hacking Workshop

33/41

7/24/2019 Advanced Excel Hacking Workshop

34/41

D?? to shellcode

0reate-emor>-oduleShell0ode.p> datapipe;dll.dll datapipe;dll.dll.5in

7/24/2019 Advanced Excel Hacking Workshop

35/41

Shellcode to #$%

shellcode7v5a.p> datapipe;dll.dll.5in datapipe;dll.dll.5in.5ase9.v5a

7/24/2019 Advanced Excel Hacking Workshop

36/41

eact*S cmd and re)edit

7/24/2019 Advanced Excel Hacking Workshop

37/41

7/24/2019 Advanced Excel Hacking Workshop

38/41

7/24/2019 Advanced Excel Hacking Workshop

39/41

7/24/2019 Advanced Excel Hacking Workshop

40/41

Putt>

7/24/2019 Advanced Excel Hacking Workshop

41/41

78G discount sale 'or $rucon:

PDF %nal>sis or"shop videos on 0D: H78

!hite 3at Shellcode or"shop videos on 0D: H78

x9 or"shop videos on 0D: H78

%ll videos on 0D: HI8

http://DidierStevens?a5s.com