# picoCTF Weird File Write Up
## Details:Points: 20
Jeopardy style CTF
Category: Forensics
Comments: What could go wrong if we let Word documents run programs? (aka "in-the-clear")
## Write up:
Based on the hint we want to see any macros in the file they provided us, we are going to use oletools:
```olevba -c ./weird.docm                                                                                                                             100 ⨯olevba 0.56 on Python 3.9.1 - http://decalage.info/python/oletools===============================================================================FILE: ./weird.docmType: OpenXMLWARNING  For now, VBA stomping cannot be detected for files in memory-------------------------------------------------------------------------------VBA MACRO ThisDocument.cls in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Sub AutoOpen()    MsgBox "Macros can run any program", 0, "Title"    Signature
End Sub  Sub Signature()    Selection.TypeText Text:="some text"    Selection.TypeParagraph  End Sub  Sub runpython()
Dim Ret_ValArgs = """" '"""Ret_Val = Shell("python -c 'print(\"cGljb0NURnttNGNyMHNfcl9kNG5nM3IwdXN9\")'" & " " & Args, vbNormalFocus)If Ret_Val = 0 Then   MsgBox "Couldn't run python script!", vbOKOnlyEnd IfEnd Sub```
I then used a base64 decoder to turn the string into the flag:
```picoCTF{m4cr0s_r_d4ng3r0us}```