Detecting MSOffice documents from the command line.

Detecting MSOffice documents from the command line.
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Detecting MSOffice documents from the command line. Bogwitch 07-05-2007
Posted by Bogwitch on July 5, 2007, 5:00 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi All,

Does anyone know of a tool or technique for detecting if an MSOffice
document of any type contains macros or if there is a command line tool
that will list the macros within a document?

TIA,

Boggy

Posted by Jerry on July 5, 2007, 5:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
What has this to do with security?

> Hi All,
>
> Does anyone know of a tool or technique for detecting if an MSOffice
> document of any type contains macros or if there is a command line tool
> that will list the macros within a document?
>
> TIA,
>
> Boggy



Posted by Me Now on July 6, 2007, 4:57 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Jerry wrote:
> What has this to do with security?
>
>> Hi All,
>>
>> Does anyone know of a tool or technique for detecting if an MSOffice
>> document of any type contains macros or if there is a command line tool
>> that will list the macros within a document?
>>
>> TIA,
>>
>> Boggy

Jerry,

When I am performing an in-depth sweep of a customers site, it would be
useful for me to differentiate between documents that contain macros and
those that don't. Those that do not contain macros require little
investigation, those that do contain macros will need the macros
examining to ensure there is no unwanted action performed my the macro.

HTH,

Boggy.

--
Posted via a free Usenet account from http://www.teranews.com


Posted by Harlan Grove on July 5, 2007, 6:36 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
>Does anyone know of a tool or technique for detecting if an MSOffice
>document of any type contains macros or if there is a command line tool
>that will list the macros within a document?

Dunno about the other document types, but if an UNENCRYPTED Excel workbook
contains general VBA modules, the workbook will contain an ASCII text string
that begins with "Module=". The names of any event handlers will also appear
as ASCII text strings, e.g., Workbook_Open.

You'd need a string lister, such as the strings.exe command found in the GNU
binutils package. Check the MinGW32 Project site or the DJGPP site for
binutils.



Posted by Me Now on July 6, 2007, 5:03 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Harlan Grove wrote:
>> Does anyone know of a tool or technique for detecting if an MSOffice
>> document of any type contains macros or if there is a command line tool
>> that will list the macros within a document?
>
> Dunno about the other document types, but if an UNENCRYPTED Excel workbook
> contains general VBA modules, the workbook will contain an ASCII text string
> that begins with "Module=". The names of any event handlers will also appear
> as ASCII text strings, e.g., Workbook_Open.
>
> You'd need a string lister, such as the strings.exe command found in the GNU
> binutils package. Check the MinGW32 Project site or the DJGPP site for
> binutils.

Thanks Harlan,

Yes, the use of strings could be useful but I suspect it is *possible*
to find the string 'Module=' elsewhere in a document. What I would like
to see is a way of detecting, perhaps via a bytecode signature, the
existence of a macro and ideally it's name.

Thanks for the infor re: Excel - I think my best bet might be to create
or gather a few samples and have a good play....

Boggy.

--
Posted via a free Usenet account from http://www.teranews.com


Similar ThreadsPosted
Set DCOM Permissions via Command Line May 18, 2006, 10:42 am
EventCombMT Command Line Options May 31, 2007, 1:37 pm
Windows defender command line utility December 14, 2006, 3:26 pm
Secedit command-line tool question June 6, 2007, 4:35 am
How do I import security policy in 2003 from command line? June 23, 2005, 2:28 pm
Updating Ad-Aware SE Personal i SpyBot S&D from command line? October 7, 2005, 4:26 am
Resetting all local policies to default on XP Pro via command line June 20, 2006, 5:39 pm
Is Putty a full replacement of the command line (openssh) client ? July 19, 2005, 1:12 pm
Searching aescipher.exe or similar command line tool with AES encryption February 15, 2007, 6:39 am
My documents permissions June 26, 2006, 8:33 pm

The site map in XML format XML site map

Contact Us | Privacy Policy