Phishing: Replacing Embedded Video with Bogus Payload

Weaponization

Create a new Word document and go to Insert > Online Video:

Insert any video:

Save the document:

Rename .docx to .zip:

Open document.xml in any code editor:

Note the embeddedHtml attribute - this is currently where the youtube iframe is embedded:

We will add our payload next inside the embeddedHtml attribute, just before the iframe markup starts. We will use the payload from the article:

File Smuggling with HTML and JavaScript

...which is almost the same as shown below:

Let's HTML encode the entire payload:

Let's put the encoded payload at the very beginning of embeddedHtml attribute:

Zip up all the files again and rename the archive back to .docx:

Execution

Open the newly backdoored document and play the video:

At this point according to https://blog.cymulate.com/abusing-microsoft-office-online-video, the payload download prompt should have been presented, but for some reason this did not happen for me:

https://blog.cymulate.com/abusing-microsoft-office-online-video

If you were able to replicate this technique and see what I missed, I would appreciate any feedback.

References

LogoBlogCymulate
LogoGitHub - rvrsh3ll/Word-Doc-Video-Embed-EXE-POCGitHub

PreviousPhishing: .SLK ExcelNextInject Macros from a Remote Dotm Template

Last updated