mgeeky/customxmlpart

A PoC weaponising CustomXMLPart for hiding malware code inside of Office document structures.

CustomXMLPart

A PoC weaponising Custom XML parts for stealthily hiding malware code inside of Office document structures.

Technical explanation described in a dedicated blog post:

• Backdooring Office Structures. Part 2: Payload Crumbs In Custom Parts

What it does?

The document provided simply displays a message box with a text extracted from a part.

---

☕ Show Support ☕

This and other projects are outcome of sleepless nights and plenty of hard work. If you like what I do and appreciate that I always give back to the community, Consider buying me a coffee (or better a beer) just to say thank you! 💪

---

Mariusz Banach / mgeeky, (@mariuszbit)
<mb [at] binary-offensive.com>

customxmlpart's Issues

CustomXMLPart/customXMLpart/customXml/item1.xml

Hello,
When I change the content of item1.xml and for example change it from "Hello world from CustomXMLpart" to " test" and when I open
customXMLpart spredsheet still shows me "Hello world from CustomXMLpart"!

Am I doing something wrong?