From 76e7be90ded1da318428bdfbc22fd661957681a4 Mon Sep 17 00:00:00 2001 From: kijeong Date: Thu, 23 Feb 2023 16:32:24 +0900 Subject: [PATCH] msodde: Fix detecting DDE in the nested field. --- oletools/msodde.py | 14 ++++++++++++-- tests/msodde/test_basic.py | 10 ++++++++++ .../dde-test-from-office365-nested-field.doc.zip | Bin 0 -> 7054 bytes 3 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 tests/test-data/msodde/dde-test-from-office365-nested-field.doc.zip diff --git a/oletools/msodde.py b/oletools/msodde.py index 303d97476..839deb276 100644 --- a/oletools/msodde.py +++ b/oletools/msodde.py @@ -309,6 +309,12 @@ def process_args(cmd_line_args=None): # separator is present. The field begin character, field end character, and # field separator are collectively referred to as field characters. +# Begin = 0x13 +# Sep = 0x14 +# End = 0x15 +# Field = * [Sep] * +# FieldList = * + def process_doc_field(data): """ check if field instructions start with DDE @@ -350,8 +356,12 @@ def process_doc_stream(stream): char = ord(char) if char == OLE_FIELD_START: - if have_start and max_size_exceeded: - logger.debug('big field was not a field after all') + if have_start: + if max_size_exceeded: + logger.debug('big field was not a field after all') + else: + logger.debug('It has multiple starts!') + continue have_start = True have_sep = False max_size_exceeded = False diff --git a/tests/msodde/test_basic.py b/tests/msodde/test_basic.py index 7eed57998..a990c914f 100644 --- a/tests/msodde/test_basic.py +++ b/tests/msodde/test_basic.py @@ -28,6 +28,7 @@ def test_valid_doc(self): 'dde-test-from-office2003.doc.zip', 'dde-test-from-office2016.doc.zip', 'dde-test-from-office2013-utf_16le-korean.doc.zip', + 'dde-test-from-office365-nested-field.doc.zip', ): with decrypt_sample(join('msodde', filename)) as temp_name: self.do_test_validity(temp_name) @@ -167,6 +168,15 @@ def test_with_dde_utf16le(self): self.assertNotEqual(len(self.get_dde_from_output(output)), 0, msg='Found no dde links in output of ' + filename) + def test_with_dde_nested_field(self): + """ check that ddeauto appear on stdout """ + filename = 'dde-test-from-office365-nested-field.doc.zip' + with decrypt_sample(join('msodde', filename)) as temp_file: + output = msodde.process_maybe_encrypted(temp_file, + field_filter_mode=msodde.FIELD_FILTER_BLACKLIST) + self.assertNotEqual(len(self.get_dde_from_output(output)), 0, + msg='Found no dde links in output of ' + filename) + def test_excel(self): """ check that dde links are found in excel 2007+ files """ expect = ['cmd /c calc.exe', ] diff --git a/tests/test-data/msodde/dde-test-from-office365-nested-field.doc.zip b/tests/test-data/msodde/dde-test-from-office365-nested-field.doc.zip new file mode 100644 index 0000000000000000000000000000000000000000..74080acf568303196b486eec25b3d7e2976c949e GIT binary patch literal 7054 zcma*sEN+WCEG`9#Q*80#1&Uj7cXzkq?(XiC2f62$dvm$u zlAFooo0%8$4}8=V;o$KAC;((YufC4tP;}$qreSml^jF@BlHsb($C^Su*!-sp3Sl{ zR7Foj=oTKz?d!h2Xyp*-yRW3JFwh>8v<+_=Wk2Y)wpfd{BW<)}FEFBnkH^8jhA~M$WNgfpOk4Ot-+880Fr_<4+r@TFO0B+~Od^Jy5!G?7`U=4#&9{ zsul?bQ<_A}zaIl!PTUPBwbaBa3`A#WsXyWTTsL8~SYXHai}k6w2)eG|%dF^WYPck1 zMkW$`fDb0eybn)!<6D@|9V#S8#?eS{a0WWvA*_}r^JiT}72eU-nU4IKuk!%djuVdb z%uNG=6Q#0Vblakz9SQ|- zy;uyG7X-6$JYu)k)Q~Yv*;VO`8eT~D2v2bqIA@teSGj0 z*v_}UQ2D@LM5s61Wqc9|;!6Wd~_avIxPxo%R$7-sKN zAmWZeu^@UZ|ApH2Z`6sl%q-%R`*!*74c{?-_=kvJ&)_zYH|jLIRvMCv>`ekt><)dc{To}ex9qJf8jA$C# z*_VSr)T19gcp82+4@m~nv#3ZtgU?lr429%b-^+dtich9FXUxmeEzf0czvhSt)t!fu zn>b#Ww^RQqT8s}t41j#b%ru~B(scXL(h(Apa@x6t3`H+O=}QSM&AH=4ihsgcB1~*= zPr>Mi6;@}S|G}#jv9~z5Ot5<=U(jmZkJxDit43|S-Mw=XOM#f0%0X@-KzynbQ)lQCy7 zIJQKO2w4`z1?wI*aq>z;6dNX}7K+{l25T}SiT3r%Yv;awZ}6$klyQ9wRc)H|jNQAGbJ($+NSt`z+ zPX$*@kqEO5ay}1Ka;iLr^2XhoIMPhY)+&9Y<|&g-n^(avyCjtjS{uT~z1Q|itAqEe zq%w72i0$#dhnJn`O?v+4G?y9al6sHNWSQO(+`x3G&QOHe{AUK;Y7=sOfhjaRuKP9M zfRxf~IixgxOPf!;YkdcUNPY=0ouGvl)8r=ws#3Xbka>v>I= zF;qdtUin}jlE@STy1e)8bvfVMj0uKV^KZt}x^R7EXIv)cH2PeY3nMSD(*Szts4x=9 z2K0ioL-d%aK5?jS6Mp^r!}+_G;3dlweWHe98OVI=C!Wu`n!4f`l??@#BpMO9Hl&EA z`hwl)pH3$iQ!~^v?HB(kd`s@g0#Y;@O1AXnKk9Mho3t1^eqFhDKhaJx!o zy-sAwp6a4}hb{nxBQ3BL2oR`_%hq^lXpY7gFiqPj78VDzT{!NqVnbHo-I_S_v za+zXl7+iTcEc+SFvVGOr4=Cekoyi$PVEX!~l$Sv0@v)?Pd`ikWivI~-_(}N4f$G7Q z*t%WbMj(KJmhIG{1@f284Z|s-=>y_%cZxkn0^zmg0W01|JPuGZ)PS>9)I5hLuV@#O zVme?0!_W>MN+58^?)H`CGxaGfOQ9KjDs`z=F3n^?4h*ip7Zf&HMcn+A_EjjE+|_XJ=SA z;t^%A{-9jU$)(hPk*iEV6Z`X4A$7ZUhZAXxs|(h1s0v2JFmrULL$5F9ez5Z3V{i#q zB8!r@ES7bM@cn0_CD(!-g~TjW^f1OOoe`207d4HHsG5mglah2Vsg4?&F_qPhP&R$b zSpuh>9d@?y7k2Mgd8Vk64E;)|Yk)v`l>jlF1lLpX+Y>%b60lHht0_?dt5&hdP=xtc zi{eRT2&p^}JuVJ}^*rCwdaXsJdyn<_N6ZF+Gc-c+_Zc0f5@?^`)wmb7vh`Ch`U^;f z>|~$P?v4WwsOl?b%I=IS{!KvNl4ww#Fo)*%+1vhbwLse!FCtH5jR!B-hzEXPRkTCM z;d`}7^+vX!pCWqR{nkZOFLOcSrlaAxo+iC3!@FEsgtzF-LPjZAAoIS;j3953Dj&ZI zzNfA}S<E$6)9!VVsevX{p44azLC> z+%mB8F^KOU7ZD>KBxmJm{3#9pJjST)V})rqEoRLIv#Fz0mVdQJqbKH;epQ z(qXTBbhNJH%;n-UMhczcQueD|o60lrdn!;Zd}Hxxiz`mWY*T9ZiGb;zKvrIdL$07r z%|aB7D(TZumIGD&WB(ZX=d8tPBbD+Ym41;c+7L{k?MI(-6u7y%LaknLNlM0#DDW%j zHVrAXg?EOZ7S5cDwlci47*g0c@4<;^j0F_p-LhwZ9a{)hog^-@I1A?|W-QuG^muRe z;E&Z`!wE5vHf_~6wHi`ewPTIAZIsacvJf^w<+(?T;VVKHWpR<5Fk@8pI2-saxuS}P zb7DYL`1W~p(~Pb;eTWPL{DH$(&+}dEErWgL*14Z-?$Eo^<)Cd`*6^%r%>@+2NBopZ z9FC-1`g5BZZ`x*129F_kE-mk%v&q=gC=7yDZD!z6jv}{;C`eWTrr&b-LlgM!q za^m_AoL3!;C;ek>FwcGxekry6sTbC`j_8RcQz}!re@1DG)>#vL{O0tA&Ap-f;N{@! zV8C)^a74~+v!7|$r2s~?q;kji!GLB)R{+feP=4C9PaEpkd=W~PqDG208XH@;+UYIR zY3*)7=a(8!Z;gb696Q%)Fq9dc6)z(tcNJmHxUB^>9w?wet{H)OYevT_0sh4oo96ey zAQ^a%y0~je6Hv*b+r7~|W1X!@ z3#nb8+-Tir(TZB>FVu}~&fzuFZthLq_p&TV$8!#lFmm>h3HvS-leLJ>i%ikWq^KC}GVER8Ewy zXc>WUT~(A+hiBF%b(q9e%)I8h!jg-bBQ%U@b;R_t#vG=fBR}7Gv+dTG&D^FL;H^<8 zh48ZG2@*1!l&!3NGlrY93lOGv%pV6KoikbncQX_Qf&@vvc*#vNhhUN$H-_k1q5%$D zbid8Ua##&4=p4$_9)Ie;@L^9UNSv(9)h2fp+zg(HGpNKEaT@N-EeT7karOn_b8=K~ z!7|YD0i%97sD_f1@8IxG6E4_Bd|bMATNVnzhUkhm{BT$e6_mQ!H9EL$pmb=*s~_RO z2@XDd7%oQQn3dmPgp^#o6dWsQ8k9O&$4%W&N$!dH4s~@TE>@}~7xV@Czuw93LMn>6 zwbx2ND35!`(8OHKXbSdkdRpM4AWoM;hK&hXQrIWxQkL5Eir5~?C<5d87c%4ugs?fB z%lPBatrC`_e6)nuFB2rBb~%2XS+8;knt~I7g%T{Sp1a#M)PA`HAEFB&VM*&ouKVcP z6A5zR=fBegA^03OMm8r=$vasn1aRXfYMOT?rAL`!CQ^?g8-*Wc+ssq>0s^akI0S#o4*kUvr3lT}FZM2@5O@6CAqUfq=@Ul^~ z4W+chrWx%h+<_LRqweAQ7^?aJ&&!hx=V+b~i&1+ZNbIjU#~2n^?nY&U?ssc>w|bwY zO>>Ul%dZ;U4kDlMB>(D9<1pFMEFdu9@7P0C_2)OK3F?mw#$u?hk2gtmB8y<5g(+){ zzuJTl!X58Rqi929b~3ERjv<)|0VC&5HYXE5E4f_Z@egX*R|HeHE)tIKtsX3@lVyQe zwH-SQFA;@snf_ohV{aRQRlBoWOKT~W+8IdPFQVo__c#5#PO)|k){@Khs3hyLi^pvPQ z493JH0_el$)@tdEOqi-|x=@$$fFO%bc;bpNl1y8c;G-LPIc*wdP4p{Yel+HN6 zx+=C;seP+VKaIw?&FUAmv;wp5WqwGQdZo(wo>J4Q=2Q{pv@^ZM?q3IHC1!p02xY6Mb*ZPLzsaMZX#dH{_PE8-t0-c;XbN-O6p9c|Lb;5Ss17jD`r(|C`Y7nJ+dVLnjK{39%}L2^aNo1vz`S%~C3!8w4U&#r&(6TWT;4{EU(X@wOA z!<=@&`s&9_+(${KSJaBI?u1lLX2BpD{66SK9C?+wl;{72ekwP2eKqZn+*0}z78_D!=+eEMoSy)WumnOdCJ_TaNOZ} z<)yQb(oczew9A$7Y`?P;nb98Tf;F9e*Kl`m=F=O{V6R>*&AY#^OOpOrujBz%xgzls zg8ft{Rn%(s@FsEdav-EjJHGYE~D;P)P}^tu`&dfK@C9MoNml&ph;_|I_Ata z+n+OtIJ*3%_~|hazP90ab-J_^UJ|r|fdiQ3l}n;M@?o&C1R{J&+U~2zour4E7z!K` zY9;TyUj#n%CG_3#%eycOIFUBV9l-$Oj9H$UIHWK(R3!#`FcBwr3`*Y1ugx|?>6isi zV9X79l{=C{@P&r-nBEf!O1Q#;NS&IBKV?sf zzG9zB{2o>X_>{At$B-Mbg)=edgIOcH>cU~7X$I~i}0{1Lkk%@vsr|m zyJoc7`Cnj=@bWq;k@=KDp0;(zhesjs&5RdoVrPq{eWn~!O-W*8P5MIo2X_dc? zK$YFl(3oC;-}^=b>!>g4#;t(7Q=^@}d5#MgORrK%UnI|XQ+3HU@M5xgpeZIN-ZnO3 z&w2D=(jX@9+$g0^b{@$97wP--0HaNtA-`5KO zlCd{rLRD(Gve(bkj@(!2w=fFrK}2eu(R?UhEKi;PScLT>JRY^`_VIZDW%m+BGsP~W z^kBSsB?Ye^sYEG&uZ@)qeNKji$Q9O;q|V`(&(WH{VaNt z;RC8rDRjF3dA!Aab9xI-KbN0MxI$8?3Kw$GB*>ed z$?aLu`MvW*jZ}qi9>M7b@8wsRV~Z|ajB1)fkhA*Cn{Oi;6ruS}I28^q z)#U{TbZaA=l3~vs!Bh2{d8p?)ng&sa#Rrle>n+Ara#MoOYe|ALG;ExeJ>53mOrj(R zRMtj}g5OTs#KayaUOff0(pYiN@RX!7OK8&n)_zI;YGyun+SLYPj!WIC;_uA;)4j#T z`nF_jPe|J`ZeaY*s+s@Bls$wk)V66ZepQ6BFuC&SDAMrWix6hC>Rgd<=O=$q({089 zR;$dpy>%25t3yeaYB$zY@uI%Es{wrhg~Ur6k`nQ&dx?HF@LIw%8oC{TH-;w)m`V=t zSHgZVGm9%nP$$14nj!+?fBwMy+y7!40F~rF+kXM& C(sUO9 literal 0 HcmV?d00001