Author, Ethan Robish, Red Team, Red Team Tools Bugging Excel files, Bugging xlsx files, Colin Edwards, Excel, Microsoft Excel, microsoft office

Bugging Microsoft Files: Part 2 – Xlsx Files using Microsoft Excel

As promised in my previous post, part 1, this post shows how to place a tracking bug in a native .xlsx file. Full credit for this method goes to Colin Edwards (see link at end of post).

The instructions below were made with Microsoft Excel 2013 for Windows.

Creating-Honey-Docs/87d48adc6bdf2df4355136dd4e8ef547.png

Open an existing document or create a new one. Choose the Data Menu.
Choose From Web.

Creating-Honey-Docs/21732112907967ed91e99e99f2e66655.png

Type the address for your tracking bug. You should come up with a unique name for this document so when it is opened later you can tell which document it was. The address should be similar to http://DOMAIN/index.php?id=ID&type=img but you need to replace DOMAIN and ID with your own values. Choose Go to load the URL you entered.
Click the tiny green arrow in the corner. This tells Excel what to read from the page. In this case, the page is blank so we choose the whole thing.

Creating-Honey-Docs/bee696115f30bff825bb61e6c4e85ede.png

Choose a cell to insert the data. It does not matter where as we will hide the whole sheet later.
Choose Properties.

Creating-Honey-Docs/Pasted_Image_10_6_16__12_59_AM.png

Check the box next to: Refresh the data when opening the file. This tells Excel to load the tracking bug every time the file is opened.
Choose OK twice.

Creating-Honey-Docs/Pasted_Image_10_6_16__1_04_AM.png

You will see data in the cell you chose. To hide this:

Choose the + symbol to add a new sheet.
Right-click the sheet where your tracking bug is.
Choose Hide.

You may want to rename the remaining sheet to something more specific.

Save the file and close Excel.

When the spreadsheet is opened, Excel will not automatically trigger the tracking bug. Instead, it will prompt the user with a security message as shown here:

Creating-Honey-Docs/Pasted_Image_10_6_16__1_08_AM.png