Detecting MSOffice documents from the command line.

[Bogwitch]

Hi All,

Does anyone know of a tool or technique for detecting if an MSOffice
document of any type contains macros or if there is a command line tool
that will list the macros within a document?

TIA,

Boggy

 

[Jerry]

What has this to do with security?

"Bogwitch" <Bogwitch@reply.to.group.fake> wrote in message
news:tZcji.6015$oa7.1176@newsfe1-gui.ntli.net...
> Hi All,
>
> Does anyone know of a tool or technique for detecting if an MSOffice
> document of any type contains macros or if there is a command line tool
> that will list the macros within a document?
>
> TIA,
>
> Boggy

 

[Harlan Grove]

"Bogwitch" <Bogwitch@reply.to.group.fake> wrote...
>Does anyone know of a tool or technique for detecting if an MSOffice
>document of any type contains macros or if there is a command line tool
>that will list the macros within a document?

Dunno about the other document types, but if an UNENCRYPTED Excel workbook
contains general VBA modules, the workbook will contain an ASCII text string
that begins with "Module=". The names of any event handlers will also appear
as ASCII text strings, e.g., Workbook_Open.

You'd need a string lister, such as the strings.exe command found in the GNU
binutils package. Check the MinGW32 Project site or the DJGPP site for
binutils.

 

[Me Now]

Jerry wrote:
> What has this to do with security?
>
> "Bogwitch" <Bogwitch@reply.to.group.fake> wrote in message
> news:tZcji.6015$oa7.1176@newsfe1-gui.ntli.net...
>> Hi All,
>>
>> Does anyone know of a tool or technique for detecting if an MSOffice
>> document of any type contains macros or if there is a command line tool
>> that will list the macros within a document?
>>
>> TIA,
>>
>> Boggy

Jerry,

When I am performing an in-depth sweep of a customers site, it would be
useful for me to differentiate between documents that contain macros and
those that don't. Those that do not contain macros require little
investigation, those that do contain macros will need the macros
examining to ensure there is no unwanted action performed my the macro.

HTH,

Boggy.

--
Posted via a free Usenet account from http://www.teranews.com

 

[Me Now]

Harlan Grove wrote:
> "Bogwitch" <Bogwitch@reply.to.group.fake> wrote...
>> Does anyone know of a tool or technique for detecting if an MSOffice
>> document of any type contains macros or if there is a command line tool
>> that will list the macros within a document?
>
> Dunno about the other document types, but if an UNENCRYPTED Excel workbook
> contains general VBA modules, the workbook will contain an ASCII text string
> that begins with "Module=". The names of any event handlers will also appear
> as ASCII text strings, e.g., Workbook_Open.
>
> You'd need a string lister, such as the strings.exe command found in the GNU
> binutils package. Check the MinGW32 Project site or the DJGPP site for
> binutils.

Thanks Harlan,

Yes, the use of strings could be useful but I suspect it is *possible*
to find the string 'Module=' elsewhere in a document. What I would like
to see is a way of detecting, perhaps via a bytecode signature, the
existence of a macro and ideally it's name.

Thanks for the infor re: Excel - I think my best bet might be to create
or gather a few samples and have a good play....

Boggy.

--
Posted via a free Usenet account from http://www.teranews.com