Peter M. Groen / oletools

Commit 3270887e63603424ab3078235fe59f1c7b1870bf

Authored by decalage2
1 parent 461d78ed

crypto: added PowerPoint transparent password '/01Hannes Ruescher/01', fixes #627

Inline Side-by-side
Showing 2 changed files with 19 additions and 9 deletions
oletools/crypto.py
  View file @3270887
... ... @@ -64,7 +64,7 @@ http://www.decalage.info/python/oletools
64 64  
65 65 # === LICENSE =================================================================
66 66  
67   -# crypto is copyright (c) 2014-2019 Philippe Lagadec (http://www.decalage.info)
  67 +# crypto is copyright (c) 2014-2021 Philippe Lagadec (http://www.decalage.info)
68 68 # All rights reserved.
69 69 #
70 70 # Redistribution and use in source and binary forms, with or without
... ... @@ -93,8 +93,10 @@ http://www.decalage.info/python/oletools
93 93 # 2019-02-14 v0.01 CH: - first version with encryption check from oleid
94 94 # 2019-04-01 v0.54 PL: - fixed bug in is_encrypted_ole
95 95 # 2019-05-23 PL: - added DEFAULT_PASSWORDS list
  96 +# 2021-05-22 v0.60 PL: - added PowerPoint transparent password
  97 +# '/01Hannes Ruescher/01' (issue #627)
96 98  
97   -__version__ = '0.55'
  99 +__version__ = '0.60.dev2'
98 100  
99 101 import sys
100 102 import struct
... ... @@ -309,12 +311,20 @@ def _is_encrypted_ole(ole):
309 311 return False
310 312  
311 313  
312   -#: one way to achieve "write protection" in office files is to encrypt the file
  314 +#: one way to achieve "write protection" in Excel files is to encrypt the file
313 315 #: using this password
314   -WRITE_PROTECT_ENCRYPTION_PASSWORD = 'VelvetSweatshop'
  316 +# ref: https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-offcrypto/6b4a08cb-195a-442e-b31c-7c94624a8c29#Appendix_A_25
  317 +# ref: https://twitter.com/BouncyHat/status/1308897568773083138
  318 +EXCEL_TRANSPARENT_PASSWORD = 'VelvetSweatshop'
  319 +
  320 +# PowerPoint password which is transparent for the user:
  321 +# ref: https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-offcrypto/57fc02f0-c1de-4fc6-908f-d146104662f5
  322 +# ref: https://twitter.com/BouncyHat/status/1308897932389896192
  323 +POWERPOINT_TRANSPARENT_PASSWORD = '/01Hannes Ruescher/01'
315 324  
316 325 #: list of common passwords to be tried by default, used by malware
317   -DEFAULT_PASSWORDS = [WRITE_PROTECT_ENCRYPTION_PASSWORD, '123', '1234', '12345', '123456', '4321']
  326 +DEFAULT_PASSWORDS = [EXCEL_TRANSPARENT_PASSWORD, POWERPOINT_TRANSPARENT_PASSWORD,
  327 + '123', '1234', '12345', '123456', '4321']
318 328  
319 329  
320 330 def _check_msoffcrypto():
... ...
setup.py
  View file @3270887
... ... @@ -33,6 +33,7 @@ to install this package.
33 33 # 2019-05-23 v0.55 PL: - added pcodedmp as dependency
34 34 # 2019-09-24 PL: - removed oletools.thirdparty.DridexUrlDecoder
35 35 # 2019-11-10 PL: - changed pyparsing from 2.2.0 to 2.1.0 for issue #481
  36 +# 2021-05-22 v0.60 PL: - entry points: added ftguess, removed olevba3/mraptor3
36 37  
37 38 #--- TODO ---------------------------------------------------------------------
38 39  
... ... @@ -52,7 +53,7 @@ import os, fnmatch
52 53 #--- METADATA -----------------------------------------------------------------
53 54  
54 55 name = "oletools"
55   -version = '0.56.2'
  56 +version = '0.60.dev2'
56 57 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
57 58 long_desc = open('oletools/README.rst').read()
58 59 author = "Philippe Lagadec"
... ... @@ -268,8 +269,9 @@ package_data={
268 269 entry_points = {
269 270 'console_scripts': [
270 271 'ezhexviewer=oletools.ezhexviewer:main',
  272 + 'ftguess=oletools.ftguess:main',
271 273 'mraptor=oletools.mraptor:main',
272   - 'mraptor3=oletools.mraptor3:main',
  274 + 'msodde=oletools.msodde:main',
273 275 'olebrowse=oletools.olebrowse:main',
274 276 'oledir=oletools.oledir:main',
275 277 'oleid=oletools.oleid:main',
... ... @@ -277,11 +279,9 @@ entry_points = {
277 279 'olemeta=oletools.olemeta:main',
278 280 'oletimes=oletools.oletimes:main',
279 281 'olevba=oletools.olevba:main',
280   - 'olevba3=oletools.olevba3:main',
281 282 'pyxswf=oletools.pyxswf:main',
282 283 'rtfobj=oletools.rtfobj:main',
283 284 'oleobj=oletools.oleobj:main',
284   - 'msodde=oletools.msodde:main',
285 285 'olefile=olefile.olefile:main',
286 286 ],
287 287 }
... ...