Classic Microsoft Excel Command Injection Exploit

The Dynamic Data Exchange (DDE) protocol in Microsoft Excel allows a spreadsheet cell to execute arbitrary commands when a user opens a malicious document. This was widely abused in phishing campaigns from 2017 onward, leading Microsoft to release mitigations and eventually disable DDE server launch by default.

How it works

A crafted formula in a cell can invoke cmd.exe or PowerShell via DDE:

=cmd|'/C powershell.exe'!z

When the victim opens the spreadsheet and enables content (or, in older versions, simply opens it), Excel spawns the specified command. The !z field is a placeholder that Excel populates with the DDE topic name.

Prerequisites

• DDE launching must be enabled in the Trust Center. By default, modern Excel versions prompt before launching DDE commands, but legacy configurations and social engineering often bypass this.
• The victim must open the file and allow the DDE link to execute (often disguised as a benign “update” prompt).

Mitigations

• Microsoft Security Advisory 4053440 (November 2017) — Provided registry settings to disable DDE in Word and Excel.
• ADV170021 — Office defense-in-depth update that set AllowDDE(DWORD) = 0 by default.
• January 2022 update (KB5010321) — Disabled DDE server launch in all supported Excel versions and added Group Policy support for Office 2016+.

Registry key to disable DDE (Excel):

[HKEY_CURRENT_USER\Software\Microsoft\Office\<version>\Excel\Security]
"DisableDDEServerLaunch"=dword:00000001

Related: visual-basic-for-applications (macro-based attacks), powershell-reverse-shell (payloads), exploit-windows-services (post-exploitation).

Sources

• Microsoft Security Advisory 4053440
• Microsoft Excel security enhancements — January 2022 update
• Rapid7 — Microsoft ADV170021

See also

• visual-basic-for-applications
• powershell-reverse-shell
• exploit-windows-services