MacSploit: Office Macro Escapes macOS Sandbox

A researcher demonstrates using a flawed sandbox regex exception in Microsoft Office for Mac to drop a LaunchAgent and escape the app sandbox, enabling unrestricted Empire C2 access.

This is a red-team research writeup (via MDSec, republished by Objective-See) detailing how Microsoft Office for Mac's sandbox entitlements can be abused to gain unrestricted code execution. The author found that Office applications (Word, Excel) are granted a temporary-exception sandbox rule permitting file read/write anywhere on disk provided the filename matches a regex intended for temp files (e.g. ~$document.docx). Because the regex is overly permissive, an attacker running VBA macro code inside the sandboxed Office process can write arbitrary files matching that pattern anywhere on the filesystem, including into ~/Library/LaunchAgents.

By dropping a malicious LaunchAgent plist that matches the temp-file regex, an attacker can have launchd execute an unsandboxed payload (e.g., a Python-based Empire agent) the next time the user logs in — or immediately by forcibly logging the user out via launchctl bootout. This effectively breaks out of the Office application sandbox that otherwise restricts network and system access for a phishing-delivered VBA macro payload generated via the Empire C2 framework's macOS/Office stager.

The technique was confirmed to work across all Microsoft Office 2016 for Mac applications supporting macros, since they share the same sandbox entitlement/exception. This is disclosed as offensive-security research intended for red-team engagements rather than observed in-the-wild attacker activity, but it demonstrates a viable initial-access-to-sandbox-escape chain relevant to phishing campaigns targeting macOS/Office users in enterprise environments.

Source reporting: https://objective-see.org/blog/blog_0x35.html