Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
print(__doc__)
parser.print_help()
print('\nAn exit code is returned based on the analysis result:')
for result in (Result_NoMacro, Result_NotMSOffice, Result_MacroOK, Result_Error, Result_Suspicious):
print(' - %d: %s' % (result.exit_code, result.name))
sys.exit()
# print banner with version
print('MacroRaptor %s - http://decalage.info/python/oletools' % __version__)
print('This is work in progress, please report issues at %s' % URL_ISSUES)
logging.basicConfig(level=LOG_LEVELS[options.loglevel], format='%(levelname)-8s %(message)s')
# enable logging in the modules:
log.setLevel(logging.NOTSET)
t = tablestream.TableStream(style=tablestream.TableStyleSlim,
header_row=['Result', 'Flags', 'Type', 'File'],
column_width=[10, 5, 4, 56])
exitcode = -1
global_result = None
# TODO: handle errors in xglob, to continue processing the next files
for container, filename, data in xglob.iter_files(args, recursive=options.recursive,
zip_password=options.zip_password, zip_fname=options.zip_fname):
# ignore directory names stored in zip files:
if container and filename.endswith('/'):
continue
full_name = '%s in %s' % (filename, container) if container else filename
# try:
# # Open the file
# if data is None:
# data = open(filename, 'rb').read()
t.write_row(['Major Version', '%04X' % ole.dll_version, 'Should be 3 or 4'])
t.write_row(['Byte Order', '%04X' % ole.byte_order, 'Should be FFFE (little endian)'])
t.write_row(['Sector Shift', '%04X' % ole.sector_shift, 'Should be 0009 or 000C'])
t.write_row(['# of Dir Sectors', ole.num_dir_sectors, 'Should be 0 if major version is 3'])
t.write_row(['# of FAT Sectors', ole.num_fat_sectors, ''])
t.write_row(['First Dir Sector', '%08X' % ole.first_dir_sector, '(hex)'])
t.write_row(['Transaction Sig Number', ole.transaction_signature_number, 'Should be 0'])
t.write_row(['MiniStream cutoff', ole.mini_stream_cutoff_size, 'Should be 4096 bytes'])
t.write_row(['First MiniFAT Sector', '%08X' % ole.first_mini_fat_sector, '(hex)'])
t.write_row(['# of MiniFAT Sectors', ole.num_mini_fat_sectors, ''])
t.write_row(['First DIFAT Sector', '%08X' % ole.first_difat_sector, '(hex)'])
t.write_row(['# of DIFAT Sectors', ole.num_difat_sectors, ''])
t.close()
print('')
print("CALCULATED ATTRIBUTES:")
t = tablestream.TableStream([24, 16, 79-(4+24+16)], header_row=['Attribute', 'Value', 'Description'])
t.write_row(['Sector Size (bytes)', ole.sector_size, 'Should be 512 or 4096 bytes'])
t.write_row(['Actual File Size (bytes)', ole._filesize, 'Real file size on disk'])
num_sectors_per_fat_sector = ole.sector_size/4
num_sectors_in_fat = num_sectors_per_fat_sector * ole.num_fat_sectors
# Need to add one sector for the header:
max_filesize_fat = (num_sectors_in_fat + 1) * ole.sector_size
t.write_row(['Max File Size in FAT', max_filesize_fat, 'Max file size covered by FAT'])
if ole._filesize > max_filesize_fat:
extra_size_beyond_fat = ole._filesize - max_filesize_fat
color = 'red'
else:
extra_size_beyond_fat = 0
color = None
t.write_row(['Extra data beyond FAT', extra_size_beyond_fat, 'Only if file is larger than FAT coverage'],
colors=[color, color, color])
# Find the last used sector:
log.info('creating output directory %s' % output_dir)
os.mkdir(output_dir)
fname_prefix = os.path.join(output_dir,
sanitize_filename(filename))
else:
base_dir = os.path.dirname(filename)
sane_fname = sanitize_filename(filename)
fname_prefix = os.path.join(base_dir, sane_fname)
# TODO: option to extract objects to files (false by default)
if data is None:
data = open(filename, 'rb').read()
print('='*79)
print('File: %r - size: %d bytes' % (filename, len(data)))
tstream = tablestream.TableStream(
column_width=(3, 10, 63),
header_row=('id', 'index', 'OLE Object'),
style=tablestream.TableStyleSlim
)
rtfp = RtfObjParser(data)
rtfp.parse()
for rtfobj in rtfp.objects:
ole_color = None
if rtfobj.is_ole:
ole_column = 'format_id: %d ' % rtfobj.format_id
if rtfobj.format_id == oleobj.OleObject.TYPE_EMBEDDED:
ole_column += '(Embedded)\n'
elif rtfobj.format_id == oleobj.OleObject.TYPE_LINKED:
ole_column += '(Linked)\n'
else:
ole_column += '(Unknown)\n'
value = getattr(meta, prop)
if value is not None:
# TODO: pretty printing for strings, dates, numbers
# TODO: better unicode handling
# print('- %s: %s' % (prop, value))
# if isinstance(value, unicode):
# # encode to UTF8, avoiding errors
# value = value.encode('utf-8', errors='replace')
# else:
# value = str(value)
t.write_row([prop, value], colors=[None, 'yellow'])
t.close()
print('')
print('Properties from the DocumentSummaryInformation stream:')
t = tablestream.TableStream([21, 30], header_row=['Property', 'Value'], outfile=console_utf8)
for prop in meta.DOCSUM_ATTRIBS:
value = getattr(meta, prop)
if value is not None:
# TODO: pretty printing for strings, dates, numbers
# TODO: better unicode handling
# print('- %s: %s' % (prop, value))
# if isinstance(value, unicode):
# # encode to UTF8, avoiding errors
# value = value.encode('utf-8', errors='replace')
# else:
# value = str(value)
t.write_row([prop, value], colors=[None, 'yellow'])
t.close()
left = sid_display(d.sid_left)
right = sid_display(d.sid_right)
child = sid_display(d.sid_child)
entry_type = STORAGE_NAMES.get(d.entry_type, 'Unknown')
etype_color = STORAGE_COLORS.get(d.entry_type, 'red')
status_color = STATUS_COLORS.get(status, 'red')
# print(' type=%7s sid_left=%s sid_right=%s sid_child=%s'
# %(entry_type, left, right, child))
# t.add_row((id, status, entry_type, name, left, right, child, hex(d.isectStart), d.size))
table.write_row((id, status, entry_type, name, left, right, child, '%X' % d.isectStart, d.size),
colors=(None, status_color, etype_color, None, None, None, None, None, None))
table = tablestream.TableStream(column_width=[4, 28, 6, 38],
header_row=('id', 'Name', 'Size', 'CLSID'),
style=tablestream.TableStyleSlim)
rootname = ole.get_rootentry_name()
entry_id = 0
clsid = ole.root.clsid
clsid_text, clsid_color = clsid_display(clsid)
table.write_row((entry_id, rootname, '-', clsid_text),
colors=(None, 'cyan', None, clsid_color))
for entry in sorted(ole.listdir(storages=True)):
name = entry[-1]
# handle non-printable chars using repr(), remove quotes:
name = repr(name)[1:-1]
name_color = None
if ole.get_type(entry) in (olefile.STGTY_STORAGE, olefile.STGTY_ROOT):
name_color = 'cyan'
indented_name = ' '*(len(entry)-1) + name
entry_id = ole._find(entry)
try:
fname_prefix = os.path.join(output_dir,
sanitize_filename(filename))
else:
base_dir = os.path.dirname(filename)
sane_fname = sanitize_filename(filename)
fname_prefix = os.path.join(base_dir, sane_fname)
# TODO: option to extract objects to files (false by default)
if data is None:
data = open(filename, 'rb').read()
print('='*79)
print('File: %r - size: %d bytes' % (filename, len(data)))
tstream = tablestream.TableStream(
column_width=(3, 10, 63),
header_row=('id', 'index', 'OLE Object'),
style=tablestream.TableStyleSlim
)
rtfp = RtfObjParser(data)
rtfp.parse()
for rtfobj in rtfp.objects:
ole_color = None
if rtfobj.is_ole:
ole_column = 'format_id: %d ' % rtfobj.format_id
if rtfobj.format_id == oleobj.OleObject.TYPE_EMBEDDED:
ole_column += '(Embedded)\n'
elif rtfobj.format_id == oleobj.OleObject.TYPE_LINKED:
ole_column += '(Linked)\n'
else:
ole_column += '(Unknown)\n'
ole_column += 'class name: %r\n' % rtfobj.class_name
# if the object is linked and not embedded, data_size=None:
if rtfobj.oledata_size is None:
def process_ole(ole):
# parse and display metadata:
meta = ole.get_metadata()
# console output with UTF8 encoding:
# It looks like we do not need the UTF8 codec anymore, both for Python 2 and 3
console_utf8 = sys.stdout #codecs.getwriter('utf8')(sys.stdout)
# TODO: move similar code to a function
print('Properties from the SummaryInformation stream:')
t = tablestream.TableStream([21, 30], header_row=['Property', 'Value'], outfile=console_utf8)
for prop in meta.SUMMARY_ATTRIBS:
value = getattr(meta, prop)
if value is not None:
# TODO: pretty printing for strings, dates, numbers
# TODO: better unicode handling
# print('- %s: %s' % (prop, value))
# if isinstance(value, unicode):
# # encode to UTF8, avoiding errors
# value = value.encode('utf-8', errors='replace')
# else:
# value = str(value)
t.write_row([prop, value], colors=[None, 'yellow'])
t.close()
print('')
print('Properties from the DocumentSummaryInformation stream:')
def show_header(ole, extra_data=False):
print("OLE HEADER:")
t = tablestream.TableStream([24, 16, 79-(4+24+16)], header_row=['Attribute', 'Value', 'Description'])
t.write_row(['OLE Signature (hex)', binascii.b2a_hex(ole.header_signature).upper(), 'Should be D0CF11E0A1B11AE1'])
t.write_row(['Header CLSID', ole.header_clsid, 'Should be empty (0)'])
t.write_row(['Minor Version', '%04X' % ole.minor_version, 'Should be 003E'])
t.write_row(['Major Version', '%04X' % ole.dll_version, 'Should be 3 or 4'])
t.write_row(['Byte Order', '%04X' % ole.byte_order, 'Should be FFFE (little endian)'])
t.write_row(['Sector Shift', '%04X' % ole.sector_shift, 'Should be 0009 or 000C'])
t.write_row(['# of Dir Sectors', ole.num_dir_sectors, 'Should be 0 if major version is 3'])
t.write_row(['# of FAT Sectors', ole.num_fat_sectors, ''])
t.write_row(['First Dir Sector', '%08X' % ole.first_dir_sector, '(hex)'])
t.write_row(['Transaction Sig Number', ole.transaction_signature_number, 'Should be 0'])
t.write_row(['MiniStream cutoff', ole.mini_stream_cutoff_size, 'Should be 4096 bytes'])
t.write_row(['First MiniFAT Sector', '%08X' % ole.first_mini_fat_sector, '(hex)'])
t.write_row(['# of MiniFAT Sectors', ole.num_mini_fat_sectors, ''])
t.write_row(['First DIFAT Sector', '%08X' % ole.first_difat_sector, '(hex)'])
t.write_row(['# of DIFAT Sectors', ole.num_difat_sectors, ''])
t.close()