Peter M. Groen / oletools

Commit 009b32d9d9843bb34934196a342f22034e406f9a

Authored by Philippe Lagadec
Committed by GitHub
2 parents 2bdc358b ed2ad178

Merge pull request #282 from ShiaoQu17/master 

Update oledir.py
Inline Side-by-side
Showing 1 changed file with 8 additions and 15 deletions
oletools/oledir.py
  View file @009b32d
@@ -123,32 +123,25 @@ KNOWN_CLSIDS = { @@ -123,32 +123,25 @@ KNOWN_CLSIDS = {
123 # MS Office files 123 # MS Office files
124 '00020906-0000-0000-C000-000000000046': 'Microsoft Word 97-2003 Document', 124 '00020906-0000-0000-C000-000000000046': 'Microsoft Word 97-2003 Document',
125 '00020900-0000-0000-C000-000000000046': 'Microsoft Word 6.0-7.0 Document', 125 '00020900-0000-0000-C000-000000000046': 'Microsoft Word 6.0-7.0 Document',
  126 + '00020832-0000-0000-C000-000000000046': 'Excel sheet with macro enabled',
  127 + '00020833-0000-0000-C000-000000000046': 'Excel binary sheet with macro enabled',
  128 +
126 # OLE Objects 129 # OLE Objects
127 '00000300-0000-0000-C000-000000000046': 'StdOleLink (embedded OLE object)', 130 '00000300-0000-0000-C000-000000000046': 'StdOleLink (embedded OLE object)',
128 - '0002CE02-0000-0000-C000-000000000046': 'MS Equation Editor (may trigger CVE-2017-11882)', 131 + '0002CE02-0000-0000-C000-000000000046': 'MS Equation Editor (may trigger CVE-2017-11882 or CVE-2018-0802)',
129 'F20DA720-C02F-11CE-927B-0800095AE340': 'Package (may contain and run any file)', 132 'F20DA720-C02F-11CE-927B-0800095AE340': 'Package (may contain and run any file)',
130 '0003000C-0000-0000-C000-000000000046': 'Package (may contain and run any file)', 133 '0003000C-0000-0000-C000-000000000046': 'Package (may contain and run any file)',
131 'D27CDB6E-AE6D-11CF-96B8-444553540000': 'Shockwave Flash Object (may trigger many CVEs)', 134 'D27CDB6E-AE6D-11CF-96B8-444553540000': 'Shockwave Flash Object (may trigger many CVEs)',
132 'A08A033D-1A75-4AB6-A166-EAD02F547959': 'otkloadr CWRAssembly Object (may trigger CVE-2015-1641)', 135 'A08A033D-1A75-4AB6-A166-EAD02F547959': 'otkloadr CWRAssembly Object (may trigger CVE-2015-1641)',
133 'D7053240-CE69-11CD-A777-00DD01143C57': 'Microsoft Forms 2.0 CommandButton', 136 'D7053240-CE69-11CD-A777-00DD01143C57': 'Microsoft Forms 2.0 CommandButton',
134 # Monikers 137 # Monikers
135 - '00000303-0000-0000-C000-000000000046': 'File Moniker',  
136 - '00000304-0000-0000-C000-000000000046': 'Item Moniker',  
137 - '00000305-0000-0000-C000-000000000046': 'Anti Moniker',  
138 - '00000306-0000-0000-C000-000000000046': 'Pointer Moniker',  
139 - '00000308-0000-0000-C000-000000000046': 'Packager Moniker', 138 + '00000303-0000-0000-C000-000000000046': 'File Moniker (may trigger CVE-2017-0199 or CVE-2017-8570)',
140 '00000309-0000-0000-C000-000000000046': 'Composite Moniker (may trigger CVE-2017-8570)', 139 '00000309-0000-0000-C000-000000000046': 'Composite Moniker (may trigger CVE-2017-8570)',
141 - '0000031a-0000-0000-C000-000000000046': 'Class Moniker',  
142 '0002034c-0000-0000-C000-000000000046': 'OutlookAttachMoniker', 140 '0002034c-0000-0000-C000-000000000046': 'OutlookAttachMoniker',
143 '0002034e-0000-0000-C000-000000000046': 'OutlookMessageMoniker', 141 '0002034e-0000-0000-C000-000000000046': 'OutlookMessageMoniker',
144 - '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B': 'URL Moniker (may trigger CVE-2017-0199)',  
145 - 'ECABB0C7-7F19-11D2-978E-0000F8757E2A': 'SOAP Moniker', 142 + '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B': 'URL Moniker (may trigger CVE-2017-0199 or CVE-2017-8570)',
  143 + 'ECABB0C7-7F19-11D2-978E-0000F8757E2A': 'SOAP Moniker (may trigger CVE-2017-8759)',
146 'ECABAFC6-7F19-11D2-978E-0000F8757E2A': 'New Moniker', 144 'ECABAFC6-7F19-11D2-978E-0000F8757E2A': 'New Moniker',
147 - # ref: https://justhaifei1.blogspot.nl/2017/07/bypassing-microsofts-cve-2017-0199-patch.html  
148 - '06290BD2-48AA-11D2-8432-006008C3FBFC': 'Factory bindable using IPersistMoniker (scripletfile)',  
149 - '06290BD3-48AA-11D2-8432-006008C3FBFC': 'Script Moniker, aka Moniker to a Windows Script Component (may trigger CVE-2017-0199)',  
150 -  
151 - '3050F4D8-98B5-11CF-BB82-00AA00BDCE0B': 'HTML Application (may trigger CVE-2017-0199)',  
152 } 145 }
153 146
154 147
@@ -272,4 +265,4 @@ def main(): @@ -272,4 +265,4 @@ def main():
272 265
273 266
274 if __name__ == '__main__': 267 if __name__ == '__main__':
275 - main()  
276 \ No newline at end of file 268 \ No newline at end of file
  269 + main()