Peter M. Groen / oletools

Commit 34a66737dca66b5b21df81623d123e2c8a1e4614

Authored by decalage2
1 parent 781e2ad2

oledir: added more CLSIDs

Inline Side-by-side
Showing 2 changed files with 18 additions and 7 deletions
oletools/oledir.py
  View file @34a6673
@@ -50,7 +50,7 @@ from __future__ import print_function @@ -50,7 +50,7 @@ from __future__ import print_function
50 # - added support for zip files and wildcards 50 # - added support for zip files and wildcards
51 # 2018-04-11 v0.53 PL: - added table displaying storage tree and CLSIDs 51 # 2018-04-11 v0.53 PL: - added table displaying storage tree and CLSIDs
52 52
53 -__version__ = '0.53dev1' 53 +__version__ = '0.53dev2'
54 54
55 #------------------------------------------------------------------------------ 55 #------------------------------------------------------------------------------
56 # TODO: 56 # TODO:
@@ -122,22 +122,33 @@ STATUS_COLORS = { @@ -122,22 +122,33 @@ STATUS_COLORS = {
122 KNOWN_CLSIDS = { 122 KNOWN_CLSIDS = {
123 # MS Office files 123 # MS Office files
124 '00020906-0000-0000-C000-000000000046': 'Microsoft Word 97-2003 Document', 124 '00020906-0000-0000-C000-000000000046': 'Microsoft Word 97-2003 Document',
  125 + '00020900-0000-0000-C000-000000000046': 'Microsoft Word 6.0-7.0 Document',
125 # OLE Objects 126 # OLE Objects
126 - '0002CE02-0000-0000-C000-000000000046': 'MS Equation Editor (may trigger CVE-2017-11882)',  
127 - # OLE Links  
128 '00000300-0000-0000-C000-000000000046': 'StdOleLink (embedded OLE object)', 127 '00000300-0000-0000-C000-000000000046': 'StdOleLink (embedded OLE object)',
  128 + '0002CE02-0000-0000-C000-000000000046': 'MS Equation Editor (may trigger CVE-2017-11882)',
  129 + 'F20DA720-C02F-11CE-927B-0800095AE340': 'Package (may contain and run any file)',
  130 + '0003000C-0000-0000-C000-000000000046': 'Package (may contain and run any file)',
  131 + 'D27CDB6E-AE6D-11CF-96B8-444553540000': 'Shockwave Flash Object (may trigger many CVEs)',
  132 + 'A08A033D-1A75-4AB6-A166-EAD02F547959': 'otkloadr CWRAssembly Object (may trigger CVE-2015-1641)',
  133 + 'D7053240-CE69-11CD-A777-00DD01143C57': 'Microsoft Forms 2.0 CommandButton',
129 # Monikers 134 # Monikers
130 '00000303-0000-0000-C000-000000000046': 'File Moniker', 135 '00000303-0000-0000-C000-000000000046': 'File Moniker',
131 '00000304-0000-0000-C000-000000000046': 'Item Moniker', 136 '00000304-0000-0000-C000-000000000046': 'Item Moniker',
132 '00000305-0000-0000-C000-000000000046': 'Anti Moniker', 137 '00000305-0000-0000-C000-000000000046': 'Anti Moniker',
133 '00000306-0000-0000-C000-000000000046': 'Pointer Moniker', 138 '00000306-0000-0000-C000-000000000046': 'Pointer Moniker',
134 '00000308-0000-0000-C000-000000000046': 'Packager Moniker', 139 '00000308-0000-0000-C000-000000000046': 'Packager Moniker',
135 - '00000309-0000-0000-C000-000000000046': 'Composite Moniker', 140 + '00000309-0000-0000-C000-000000000046': 'Composite Moniker (may trigger CVE-2017-8570)',
136 '0000031a-0000-0000-C000-000000000046': 'Class Moniker', 141 '0000031a-0000-0000-C000-000000000046': 'Class Moniker',
137 '0002034c-0000-0000-C000-000000000046': 'OutlookAttachMoniker', 142 '0002034c-0000-0000-C000-000000000046': 'OutlookAttachMoniker',
138 '0002034e-0000-0000-C000-000000000046': 'OutlookMessageMoniker', 143 '0002034e-0000-0000-C000-000000000046': 'OutlookMessageMoniker',
139 - '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B': 'URL Moniker', 144 + '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B': 'URL Moniker (may trigger CVE-2017-0199)',
140 'ECABB0C7-7F19-11D2-978E-0000F8757E2A': 'SOAP Moniker', 145 'ECABB0C7-7F19-11D2-978E-0000F8757E2A': 'SOAP Moniker',
  146 + 'ECABAFC6-7F19-11D2-978E-0000F8757E2A': 'New Moniker',
  147 + # ref: https://justhaifei1.blogspot.nl/2017/07/bypassing-microsofts-cve-2017-0199-patch.html
  148 + '06290BD2-48AA-11D2-8432-006008C3FBFC': 'Factory bindable using IPersistMoniker (scripletfile)',
  149 + '06290BD3-48AA-11D2-8432-006008C3FBFC': 'Script Moniker, aka Moniker to a Windows Script Component (may trigger CVE-2017-0199)',
  150 +
  151 + '3050F4D8-98B5-11CF-BB82-00AA00BDCE0B': 'HTML Application (may trigger CVE-2017-0199)',
141 } 152 }
142 153
143 154
@@ -153,7 +164,7 @@ def clsid_display(clsid): @@ -153,7 +164,7 @@ def clsid_display(clsid):
153 if clsid in KNOWN_CLSIDS: 164 if clsid in KNOWN_CLSIDS:
154 clsid += '\n%s' % KNOWN_CLSIDS[clsid] 165 clsid += '\n%s' % KNOWN_CLSIDS[clsid]
155 color = 'yellow' 166 color = 'yellow'
156 - if 'CVE-' in clsid: 167 + if 'CVE' in clsid:
157 color = 'red' 168 color = 'red'
158 return (clsid, color) 169 return (clsid, color)
159 170
setup.py
  View file @34a6673
@@ -43,7 +43,7 @@ import os, fnmatch @@ -43,7 +43,7 @@ import os, fnmatch
43 #--- METADATA ----------------------------------------------------------------- 43 #--- METADATA -----------------------------------------------------------------
44 44
45 name = "oletools" 45 name = "oletools"
46 -version = '0.53dev1' 46 +version = '0.53dev2'
47 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR" 47 desc = "Python tools to analyze security characteristics of MS Office and OLE files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), for Malware Analysis and Incident Response #DFIR"
48 long_desc = open('oletools/README.rst').read() 48 long_desc = open('oletools/README.rst').read()
49 author = "Philippe Lagadec" 49 author = "Philippe Lagadec"