Office in Wonderland

## Overview

In the presentation **Office in Wonderland**, red teamers Peter and Stan from Outflank explore ways to abuse Microsoft Office beyond conventional VBA macros and Dynamic Data Exchange (DDE) code execution. The speakers demonstrate how both legacy Word and Excel features—as well as newer capabilities like Power BI integrations—can be manipulated to achieve high-impact outcomes without requiring code execution, such as credential harvesting and arbitrary file exfiltration. They also investigate the inner workings of macro execution, showcasing code execution capabilities using legacy Excel 4.0 (XLM) macros.

---

## Credential Harvesting via Legacy Word Fields

Rather than attempting direct code execution, attackers can leverage legacy Microsoft Word fields (found under the "Quick Parts" menu) to steal user credentials:

- **Tracking and Content Retrieval:** Word fields such as `INCLUDEPICTURE` allow dynamic retrieval of remote resources over HTTP without embedding the image inside the document, functioning like a tracking pixel. - **Dynamic URL and Basic Authentication Abuse (CVE-2018-0540 / CVE-0540):** While standard `INCLUDEPICTURE` fields ignore basic authentication challenges, nesting a dynamic `USERNAME` field inside an `INCLUDEPICTURE` URL inside a Word template (`.dot` or `.dotx`) changes this behavior. - **Attack Mechanism:** When the user double-clicks the template, the username string updates dynamically in the header, triggering Word to process HTTP Basic Authentication prompts. Word displays a legitimate-looking authentication pop-up (appearing similar to a SharePoint login). As long as the attacker's web server responds with failed authentication, Word continues prompting the user, trapping them until credentials are provided. Microsoft patched this issue in January after a multi-month disclosure cycle.

---

## Arbitrary File Exfiltration via Word Fields & Excel Power Query (M)

The speakers demonstrated two distinct methodologies for exfiltrating local files from a target system without code execution:

### 1. Nested Word Fields (`INCLUDETEXT` & `MACROBUTTON`) - **Reviving Legacy Vectors:** An older vulnerability from 2002 abused `INCLUDETEXT` to load local files into a document, but Microsoft addressed it by preventing automatic updates of the field. - **Forcing Updates with `MACROBUTTON`:** The researchers bypassed this restriction by wrapping an `INCLUDETEXT` field and an exfiltration `INCLUDEPICTURE` field within a `MACROBUTTON` field disguised as a lure ("Double-click to see the monkey dance"). - **Execution:** When the user double-clicks the macro button element, all contained fields are forced to evaluate. The document reads local files (such as `C:\unattend.xml`), appends the URL-encoded contents to an outbound HTTP request, and transmits it to the attacker's server. Microsoft remediated this by adding a security warning notifying users that the document contains fields capable of sharing data with external parties.

### 2. Abuse of Excel "Get & Transform" (Power Query / M Language) - **Feature Misuse:** Excel integrates Power BI's "Get & Transform" feature, which uses the `M` formula language. - **Local Read & Exfiltration:** Attackers can craft an `M` script that imports a local file (e.g., `C:\unattend.xml`) as a CSV or text file and populates sheet cells (e.g., column `A1`). A secondary Excel web service formula (`WEBSERVICE`) then reads the imported content line-by-line and exfiltrates it to an external server. - **Impact & Scope:** Users see only a generic, low-suspicion warning regarding external data connections rather than a macro warning. The Get & Transform engine can also target structured XML via XPath queries, database connections, Azure services, and Active Directory.

---

## Beyond VBA: Deep Dive into Excel 4.0 (XLM) Macros

Stan outlined how macro abuse extends far beyond Visual Basic for Applications:

- **Native Excel Architecture:** Unlike VBA—which runs inside a separate DLL that can be monitored or restricted by solutions like AppLocker—Excel 4.0 (XLM) macros are executed directly inside the core `excel.exe` process binary. - **Longevity and Operation:** Supported since 1992, XLM macros run in dedicated macro sheets. Basic functions such as `=EXEC("calculator")` can run executables, and cells can be named `Auto_Open` to trigger automatically upon document launch. Macro sheets can also be hidden from the standard GUI. - **Direct Win32 API Invocations:** Beyond simple commands, XLM macros support direct interaction with Win32 APIs. The speakers demonstrated full in-memory shellcode injection by sequentially calling Windows API functions—specifically `VirtualAlloc`, `WriteProcessMemory`, and `CreateThread`—directly from macro sheet cells.