0xdeadbeefJERKY/Office-DDE-Payloads

Conditional payload execution

v-p-b opened this issue · 1 comments

v-p-b commented

I'm wondering if conditional execution primitives could be integrated to this tool - they are pretty useful for bypassing sandboxes/nextgen protections:

https://blog.silentsignal.eu/2017/12/05/conditional-dde/

I'll have to do a bit more research and testing before integrating this into the tool, but the technique seems promising. You're obviously limited in the conditions that can be implemented, but nonetheless can improve OPSEC. Additionally, you can leverage the tool's obfuscation technique to host an Office file remotely containing the values you want to check against within the conditional statements. Thanks for bringing this to my attention!