Office for Mac Macro Payload Generator

There are 4 attack vectors available:

• beacon
• creds
• meterpreter
• meterpreter-grant

For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell.

On execution, this payload will signal our listening host and provide basic system information about the victim. The simplest way of generating a beacon payload is:

By default, it uses curl but other utilities (wget, nslookup) can be used by modifying the command template.

The simplest way of generating a meterpreter payload is:

The generate a meterpreter payload that calls GrantAccessToMultipleFiles() first:

For meterpreter attacks, only python payloads are supported at the moment.

See https://github.com/cldrn/macphish/wiki/Usage

• Sandbox evasion using GrantAccessToMultipleFiles in word for mac
• PoC of Global And Recursive Permissions - Malicious macros for Word in MacOS
• Meterpreter execution in Office For Mac with macros
• Credential Harvesting (Phishing) with Word macros in macOS