Peter M. Groen / oletools

Commit 34a66737dca66b5b21df81623d123e2c8a1e4614

Authored by decalage2
1 parent 781e2ad2

oledir: added more CLSIDs

Inline Side-by-side
Showing 2 changed files with 18 additions and 7 deletions
oletools/oledir.py
  View file @34a6673
... ... @@ -50,7 +50,7 @@ from __future__ import print_function
50 50 # - added support for zip files and wildcards
51 51 # 2018-04-11 v0.53 PL: - added table displaying storage tree and CLSIDs
52 52  
53   -__version__ = '0.53dev1'
  53 +__version__ = '0.53dev2'
54 54  
55 55 #------------------------------------------------------------------------------
56 56 # TODO:
... ... @@ -122,22 +122,33 @@ STATUS_COLORS = {
122 122 KNOWN_CLSIDS = {
123 123 # MS Office files
124 124 '00020906-0000-0000-C000-000000000046': 'Microsoft Word 97-2003 Document',
  125 + '00020900-0000-0000-C000-000000000046': 'Microsoft Word 6.0-7.0 Document',
125 126 # OLE Objects
126   - '0002CE02-0000-0000-C000-000000000046': 'MS Equation Editor (may trigger CVE-2017-11882)',
127   - # OLE Links
128 127 '00000300-0000-0000-C000-000000000046': 'StdOleLink (embedded OLE object)',
  128 + '0002CE02-0000-0000-C000-000000000046': 'MS Equation Editor (may trigger CVE-2017-11882)',
  129 + 'F20DA720-C02F-11CE-927B-0800095AE340': 'Package (may contain and run any file)',
  130 + '0003000C-0000-0000-C000-000000000046': 'Package (may contain and run any file)',
  131 + 'D27CDB6E-AE6D-11CF-96B8-444553540000': 'Shockwave Flash Object (may trigger many CVEs)',
  132 + 'A08A033D-1A75-4AB6-A166-EAD02F547959': 'otkloadr CWRAssembly Object (may trigger CVE-2015-1641)',
  133 + 'D7053240-CE69-11CD-A777-00DD01143C57': 'Microsoft Forms 2.0 CommandButton',
129 134 # Monikers
130 135 '00000303-0000-0000-C000-000000000046': 'File Moniker',
131 136 '00000304-0000-0000-C000-000000000046': 'Item Moniker',
132 137 '00000305-0000-0000-C000-000000000046': 'Anti Moniker',
133 138 '00000306-0000-0000-C000-000000000046': 'Pointer Moniker',
134 139 '00000308-0000-0000-C000-000000000046': 'Packager Moniker',
135   - '00000309-0000-0000-C000-000000000046': 'Composite Moniker',
  140 + '00000309-0000-0000-C000-000000000046': 'Composite Moniker (may trigger CVE-2017-8570)',
136 141 '0000031a-0000-0000-C000-000000000046': 'Class Moniker',
137 142 '0002034c-0000-0000-C000-000000000046': 'OutlookAttachMoniker',
138 143 '0002034e-0000-0000-C000-000000000046': 'OutlookMessageMoniker',
139   - '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B': 'URL Moniker',
  144 + '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B': 'URL Moniker (may trigger CVE-2017-0199)',
140 145 'ECABB0C7-7F19-11D2-978E-0000F8757E2A': 'SOAP Moniker',
  146 + 'ECABAFC6-7F19-11D2-978E-0000F8757E2A': 'New Moniker',
  147 + # ref: https://justhaifei1.blogspot.nl/2017/07/bypassing-microsofts-cve-2017-0199-patch.html
  148 + '06290BD2-48AA-11D2-8432-006008C3FBFC': 'Factory bindable using IPersistMoniker (scripletfile)',
  149 + '06290BD3-48AA-11D2-8432-006008C3FBFC': 'Script Moniker, aka Moniker to a Windows Script Component (may trigger CVE-2017-0199)',
  150 +
  151 + '3050F4D8-98B5-11CF-BB82-00AA00BDCE0B': 'HTML Application (may trigger CVE-2017-0199)',
141 152 }
142 153  
143 154  
... ... @@ -153,7 +164,7 @@ def clsid_display(clsid):
153 164 if clsid in KNOWN_CLSIDS:
154 165 clsid += '\n%s' % KNOWN_CLSIDS[clsid]
155 166 color = 'yellow'
156   - if 'CVE-' in clsid:
  167 + if 'CVE' in clsid:
157 168 color = 'red'
158 169 return (clsid, color)
159 170  
... ...
setup.py
  View file @34a6673
... ... @@ -43,7 +43,7 @@ import os, fnmatch
43 43 #--- METADATA -----------------------------------------------------------------
44 44  
45 45 name = "oletools"
46   -version = '0.53dev1'
  46 +version = '0.53dev2'
47 47 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
48 48 long_desc = open('oletools/README.rst').read()
49 49 author = "Philippe Lagadec"
... ...