-
Notifications
You must be signed in to change notification settings - Fork 1
/
activemime2ole.py
executable file
·64 lines (45 loc) · 1.71 KB
/
activemime2ole.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
#!/bin/env python
"""
Extract OLE object from ActiveMime, based on hints from @decalage2
See:
https://twitter.com/decalage2/status/573175912612687873
https://isc.sans.edu/forums/diary/XML+A+New+Vector+For+An+Old+Trick/19423/
http://sanesecurity.blogspot.nl/2015/03/remittance-advice-rem-xml.html
http://www.file-extensions.org/mso-file-extension-activemime-object-file
Author: Michal Ambroz <rebus@seznam.cz>
License: Gnu General Public License
Copyright (C) 2015 Michal Ambroz <rebus@seznam.cz>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
import sys
import zlib
def am2ole(activemime):
try:
#This should work for Word
return zlib.decompress(activemime[0x32:])
except:
None
try:
#This should work for Excel
return zlib.decompress(activemime[0x22A:])
except:
return ""
#==== Main ===============================
def main():
filename = sys.argv[1]
i=0
f=open(filename,'r')
activemime=f.read()
print "%s" % am2ole(activemime)
#===============================================================================
if __name__ == '__main__':
main()