> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes-2-0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/initial-access/t1566-phishing/phishing-spearphishing-attachment/attachments-macros-linux.md). # Attachments: Macros - Linux Macros can be utilize with Linux as well, since there is no official support to run Microsoft Office on Linux we have to mess around with the alternative version called LibreOffice, this suite of tools allow Macros as well wit there own Scripting Language [LibreOffice Basic](https://help.libreoffice.org/6.1/en-US/text/sbasic/shared/01000000.html) some advantages of this method of Initial Access is that there is no MOTW, now setting up macro execution is quite simple, we don't have the access to the Win32 API or any other implementations that are used with windows so will work with what we have, in the following example I scripted to execute the Calculator on Linux ``` Sub Main Shell("gnome-calculator") End Sub ``` With this code the calculator will launch when the Macro is executed, now implementing the Open Document execution so the Macro runs when the document has been opened with the following steps: Tools > Customize > Events > Open Document Verify the window looks similar to the one below to confirm that the Macro you are working with is actually selected to run when open

View below a small demonstration that the Macro has been executed successfully

Now unfortunately this method works because the macros are stored on my Local Machine and that's where it is executing from when sending to the user the Macro needs to be stored on the file not the local Library

And Macros by default are on High Security

The only option is to run these files on a trusted location

And then Social Engineer to execute the Macros, since there is not "AutoOpen" feature in LibreOffice. ### OLE Objects Now with OLE Objects we can utilize a technique called "Mouse Over Object" where we can select our Macro embedded onto the Document and Assign it the Action in this scenario there is no need for a Trusted Locations, In this example I used a formula which is the smallest I could quickly find:

Then right-click and Assign the Action

And when the User hovers over the OLE Object we gain execution as seen in the Demo below:

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/initial-access/t1566-phishing/phishing-spearphishing-attachment/attachments-macros-linux.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.