If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Detecting MSOffice documents from the command line.
Hi All,
Does anyone know of a tool or technique for detecting if an MSOffice document of any type contains macros or if there is a command line tool that will list the macros within a document? TIA, Boggy |
#2
|
|||
|
|||
Detecting MSOffice documents from the command line.
What has this to do with security?
"Bogwitch" wrote in message ... Hi All, Does anyone know of a tool or technique for detecting if an MSOffice document of any type contains macros or if there is a command line tool that will list the macros within a document? TIA, Boggy |
#3
|
|||
|
|||
Detecting MSOffice documents from the command line.
"Bogwitch" wrote...
Does anyone know of a tool or technique for detecting if an MSOffice document of any type contains macros or if there is a command line tool that will list the macros within a document? Dunno about the other document types, but if an UNENCRYPTED Excel workbook contains general VBA modules, the workbook will contain an ASCII text string that begins with "Module=". The names of any event handlers will also appear as ASCII text strings, e.g., Workbook_Open. You'd need a string lister, such as the strings.exe command found in the GNU binutils package. Check the MinGW32 Project site or the DJGPP site for binutils. |
#4
|
|||
|
|||
Detecting MSOffice documents from the command line.
Jerry wrote:
What has this to do with security? "Bogwitch" wrote in message ... Hi All, Does anyone know of a tool or technique for detecting if an MSOffice document of any type contains macros or if there is a command line tool that will list the macros within a document? TIA, Boggy Jerry, When I am performing an in-depth sweep of a customers site, it would be useful for me to differentiate between documents that contain macros and those that don't. Those that do not contain macros require little investigation, those that do contain macros will need the macros examining to ensure there is no unwanted action performed my the macro. HTH, Boggy. -- Posted via a free Usenet account from http://www.teranews.com |
#5
|
|||
|
|||
Detecting MSOffice documents from the command line.
Harlan Grove wrote:
"Bogwitch" wrote... Does anyone know of a tool or technique for detecting if an MSOffice document of any type contains macros or if there is a command line tool that will list the macros within a document? Dunno about the other document types, but if an UNENCRYPTED Excel workbook contains general VBA modules, the workbook will contain an ASCII text string that begins with "Module=". The names of any event handlers will also appear as ASCII text strings, e.g., Workbook_Open. You'd need a string lister, such as the strings.exe command found in the GNU binutils package. Check the MinGW32 Project site or the DJGPP site for binutils. Thanks Harlan, Yes, the use of strings could be useful but I suspect it is *possible* to find the string 'Module=' elsewhere in a document. What I would like to see is a way of detecting, perhaps via a bytecode signature, the existence of a macro and ideally it's name. Thanks for the infor Excel - I think my best bet might be to create or gather a few samples and have a good play.... Boggy. -- Posted via a free Usenet account from http://www.teranews.com |
Thread Tools | |
Display Modes | |
|
|