T1221: Template Injection

Adversaries may create or modify references in Office document templates to conceal malicious code or force authentication attempts. Microsoft's Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, .xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.

Properties within parts may reference shared public resources access via online URLs. For example, template properties reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.

Adversaries mat abuse this technology to initially conceal malicious code to be executed via documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded. These documents can be delivered via other techniques such as Phishing and/or Taint Shared Content and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched. Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.

This technique may also enable Forced Authentication by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.

Example

For this Demo we now create a docs file that will try and reach out to our attacking machine from a remote source. The easiest way to do this is to create a doc document from one of the provided Word templates, and just modify the target.

Now we will just need to modify the document to accommodate it to our phishing needs, with the release of Office 2007, Microsoft introduced formats that end with the 'x' character, each of these formats are just zip files containing mostly .xml and .rel files. We are going to manually edit these properly and then zip them back together.

Once unzip we will navigate to the word >> _rels >> settings.xml file and search for the Target value.

We edit it to point to our remote host.

Once the file is being loaded you will notice it's trying to reach out to our Remote Host

I set responder to be listening for any traffic

Note:

OK so I was trying to Unzip the files but was getting errors that the file was damaged, so to get around this all I did was drag and drop the payload to the normal file just to replace the document, instead of unzipping the file all I did was rename it to ZIP so I can access the XML files

In the upper image I just dragged and dropped the upper file to the bottom window and renamed it back to docx WITHOUT the unzipping

Demo:

References:

Executing Macros From a DOCX With Remote Template Injection

Playing defense against Gamaredon GroupElastic Blog

Attack on Critical Infrastructure Leverages Template Injection