Guest Bogwitch Posted July 5, 2007 Posted July 5, 2007 Hi All, Does anyone know of a tool or technique for detecting if an MSOffice document of any type contains macros or if there is a command line tool that will list the macros within a document? TIA, Boggy Quote
Guest Jerry Posted July 5, 2007 Posted July 5, 2007 What has this to do with security? "Bogwitch" <Bogwitch@reply.to.group.fake> wrote in message news:tZcji.6015$oa7.1176@newsfe1-gui.ntli.net... > Hi All, > > Does anyone know of a tool or technique for detecting if an MSOffice > document of any type contains macros or if there is a command line tool > that will list the macros within a document? > > TIA, > > Boggy Quote
Guest Harlan Grove Posted July 5, 2007 Posted July 5, 2007 "Bogwitch" <Bogwitch@reply.to.group.fake> wrote... >Does anyone know of a tool or technique for detecting if an MSOffice >document of any type contains macros or if there is a command line tool >that will list the macros within a document? Dunno about the other document types, but if an UNENCRYPTED Excel workbook contains general VBA modules, the workbook will contain an ASCII text string that begins with "Module=". The names of any event handlers will also appear as ASCII text strings, e.g., Workbook_Open. You'd need a string lister, such as the strings.exe command found in the GNU binutils package. Check the MinGW32 Project site or the DJGPP site for binutils. Quote
Guest Me Now Posted July 6, 2007 Posted July 6, 2007 Jerry wrote: > What has this to do with security? > > "Bogwitch" <Bogwitch@reply.to.group.fake> wrote in message > news:tZcji.6015$oa7.1176@newsfe1-gui.ntli.net... >> Hi All, >> >> Does anyone know of a tool or technique for detecting if an MSOffice >> document of any type contains macros or if there is a command line tool >> that will list the macros within a document? >> >> TIA, >> >> Boggy Jerry, When I am performing an in-depth sweep of a customers site, it would be useful for me to differentiate between documents that contain macros and those that don't. Those that do not contain macros require little investigation, those that do contain macros will need the macros examining to ensure there is no unwanted action performed my the macro. HTH, Boggy. -- Posted via a free Usenet account from http://www.teranews.com Quote
Guest Me Now Posted July 6, 2007 Posted July 6, 2007 Harlan Grove wrote: > "Bogwitch" <Bogwitch@reply.to.group.fake> wrote... >> Does anyone know of a tool or technique for detecting if an MSOffice >> document of any type contains macros or if there is a command line tool >> that will list the macros within a document? > > Dunno about the other document types, but if an UNENCRYPTED Excel workbook > contains general VBA modules, the workbook will contain an ASCII text string > that begins with "Module=". The names of any event handlers will also appear > as ASCII text strings, e.g., Workbook_Open. > > You'd need a string lister, such as the strings.exe command found in the GNU > binutils package. Check the MinGW32 Project site or the DJGPP site for > binutils. Thanks Harlan, Yes, the use of strings could be useful but I suspect it is *possible* to find the string 'Module=' elsewhere in a document. What I would like to see is a way of detecting, perhaps via a bytecode signature, the existence of a macro and ideally it's name. Thanks for the infor re: Excel - I think my best bet might be to create or gather a few samples and have a good play.... Boggy. -- Posted via a free Usenet account from http://www.teranews.com Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.