Thread by @DissectMalware

#VBA declare statement: from libname #obfuscation to remote dll loading 🧵

Declare is used to declare a ref to an external proc in a DLL

Syntax:
[Public | Private] Declare Function name Lib "libname" [Alias "aliasname"] [ ( [arglist] ) ] [As type]

ref: docs.microsoft.com/en-us/office/v…

0⃣ both "kernel32" and "kernel32.dll" are acceptable libnames
1⃣ padding with space chars " kernel32 "
2⃣ adding arbitrary . to the mix " kernel32 .. .. . "

Is libname actually a file path? yes
3⃣ "c:\Windows\System32\kernel32.dll"
can we use relative addressing?
4⃣ "..\..\..\..\../\..\\.\windows\system32\kernel32"
can we use file protocol?
5⃣ " file:///../../../../\/./windows/system32/Kernel32.dll ... "

can we load from a shared folder? absolutely
6⃣"\\127.0.0.1\c$\windows\system32\Kernel32.dll"

can we load our dll? yup
7⃣ "\\127.0.0.1\c$\users\poc-calc.dll"

Lesson learned:
You can heavily obfuscate libname
You can load a dll into office from a remote location🔹

🔷 Reported to MSRC: by design

PoC:
xlsm: github.com/DissectMalware…

poc-calc.dll: github.com/DissectMalware…

or compile: github.com/CuckooEXE/PopC…

place the dll in c:\users if you don't want to change the xlsm file