Normal.dotmtemplate locally, the Name of the AutoText, in this case "Finance", will throw a reference error. This underlines the need to host the AutoText snippet in a source that can be statically referenced, such as a remote template file.
Switchupon opening the file, which swaps out the main content of a document with the contents of the AutoText entry which will be created in the next step.
Shellzthen pops calc.exe as a placeholder for code execution.
Insert -> Quick Parts -> AutoText -> Save Selection to AutoText Gallery
.docx. Using the same pretext selected for the scenario, in this case financial data, create and save the document. Notice that the content restriction control which prevents macro code execution has been screenshotted, placed at the top-middle region of the document, and pointed out prominently (with a red box) to the user as the reason they can't see "real data".
.zip. Unzip the archive and edit
TargetXML node in the
settings.xml.relsto the hostname of the payload server.
.docxarchive, making sure there is no root directory encapsulating the rest of the
.docxstructure. Structural changes to the directory structure of the
.zipwill corrupt the Office file parser and error out.