Macrome - Excel Macro Document Reader/Writer For Red Teamers And Analysts

An Excel Macro Document Reader/Writer for Red Teamers & Analysts. Blog posts describing what this tool actually does can be found here and here.

Installation / Building

Clone or download this repository, the tool can then be executed using dotnet - for example:

dotnet run -- build --decoy-document Docs\decoy_document.xls --payload Docs\popcalc.bin 

or

deobfuscate --path obfuscated_document.xls">

dotnet build
cd bin/Debug/netcoreapp2.0
dotnet Macrome.dll deobfuscate --path obfuscated_document.xls

Note that a 5.0+ build of dotnet is required for this to work as configured …

excel macro msfvenom reader undetected windows