1. » Looking for ways to help your Team advance their Initial Access capabilities?
2. » Spending too much time manually devising shellcode loaders, payloads, scripts, macros?
3. » Looking for ways to bypass MOTW, utilize containers, backdoor documents - all of that conveniently with automated tooling?
4. » Eager to try out Multi-Language (C#, C++, soon even more!), flexible, evasive Shellcode Loader implementing variety of code injection techniques?
5. » Curious in emulating over 17+ ready-made advanced complex infection scenarios?
6. » Looking to expand your Team's initial access payloads repertoire?

With Red Macros Factory you can generate 76+ obfuscated, fully weaponized vectors in a glimpse of an eye

• Shellcode Loaders:
  • » Built in various languages: C++, C#, ...
  • » Support variety of compilers: MinGW, MSVC, LLVM clang, MSbuild, csc, ...
  • » Variety of shellcode injection techniques: CreateThread, DirtyCLR, ...
  • » Multiple output formats supported: exe, dll, cpl, xll, wll, ...
  • » Various shellcode retrieval strategies: hardcoded, file, URL, environment variables, ...
  • » Shellcode encryption & compression support out-of-the-box
  • » A range of evasions: Anti-Sandbox, execution guardrails, time-delays, ...
• Office documents (29+):
  • » Word: .doc, .docm, .dotm, .dot, .rtf, .mht
  • » Excel: .xls, .xlsm, .xltm, .xlt, .xlsb, .xla, .xlam
  • » PowerPoint: .pptm, .ppsm, .potm
  • » Access: .mdb, .accde
  • » Visio: .vdw, .vsd, .vsdm, .vss, .vssm, .vstm, .vst
  • » Project: .mpp, .mpt
  • » Publisher: .pub
  • » Outlook: .otm (used in Outlook persistence scenarios)
• Scripts (11):
  • » .vba
  • » .vbs: VBscript
  • » .vbe: VBScript encoded
  • » .js: JScript / JXA
  • » .jse: Jscript encoded
  • » .msc: Microsoft Management Console Snap-in
  • » .hta: HTML Application containing VBscript/JScript
  • » .xsl: XML containing VBScript/JScript
  • » .wsf: XML containing VBScript/JScript
  • » .wsc: COM Scriptlet containing VBScript/JScript
• Containers (20+):
  • » .zip: can contain hidden files
  • » .7zip
  • » .rar
  • » .iso: can contain hidden files
  • » .img: ISO-renamed, can contain hidden files
  • » .gz, .tar.gz, .tar.bz2, .tar, .tar.xz, .tar.zst, .tzst, .tbz2, .tgz, .txz : various tarballs, bzip2 and other linux archives
  • » .sz / .szdd / .kwaj - MSCOMPRESS legacy archive format
  • » .cab
  • » .wim
  • » .vhd
  • » .vhdx
  • » .cpio: archive format supported by Apple's Archiver Utility, dubbed as Regular Archive
  • » .cpgz: archive format supported by Apple's Archiver Utility, dubbed as Compressed Archive
  • » .pdf: files embedded into PDF
  • » .lnk: LNK with appended file/ZIP, uses Powershell to unpack itself
  • » .rdp: idea to conceal payloads within RDP files, as described here
• Other vectors (16):
  • » .application, .manifest, .appref-ms: ClickOnce deployment files
  • » .bat, .cmd: Classic cmd.exe batch files
  • » .ps1: Powershell scripts
  • » .html, .svg: HTML Smuggling, SVG Smuggling
  • » .lnk: Windows shortcut
  • » .url: a shortcut that can launch direct victim onto URL in default browser or launch locally available file through file:///path/to/file.exe URI-handler
  • » .chm: can run system commands, useful in complex infection scenarios
  • » .msi: malicious MSI installer or backdoored MSI
  • » .mst: Installation transform file
  • » .msp: Installation patch file, backdoors legitimate MSI
  • » .msg: BadAppointment attack, implements malicious appointment to coerce NetNTLM authentication
  • » .diagcab: path-traversal enabled CAB file exploiting Dogwalk exploit, generated with exploiter.exe
  • » .inf: INF installation file invoking SCT, in an INF-SCT weaponization scenario