Detect interactive ppt features #786
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Rebased onto branch #769 , fixing unittests... |
christian-intra2net
force-pushed
the
detect-interactive-ppt-features
branch
from
61da9f0
to
7fe4055
Compare
|
...done. Ready for merge at your disgression. (Note: first two commits are #769 so I could unittest) |
|
Another note: could add sample from #784 to unittests, this branch should solve problems there. However, we have no actual malware in our test set yet (although we could add it as encrypted zip), not sure whether we want that. |
christian-intra2net
force-pushed
the
detect-interactive-ppt-features
branch
from
1ab4420
to
799b588
Compare
|
Found a bug in one of the commits. Fixed it and added unittests to avoid this in the future. |
christian-intra2net
force-pushed
the
detect-interactive-ppt-features
branch
from
799b588
to
590d905
Compare
(new IDE complained about these)
Parse more record types from [MS-PPT] and some more from [MS-ODRAW], show more info in __str__ for debugging and extending
Old powerpoint files (.ppt) can contain links to webpages or programs that are neither ActiveX nor VBA nor other tested types. They are saved in regular ppt-specific records and allow powerpoint to start arbitrary commands upon click or hovering over some item. The tineout for "hovering" is pretty fast here, it is very likely that users trigger this without realizing it. Add detection for these items to olevba
Expose existing param in record_base.test which is used to help extend and debug record-based streams (currently only ppt_record_parser).
(1) Do not parse all sub-records in a container when constructing it (2) Allow for stray bytes at end of container data
Had too harsh a requirement for ppt files, that it only contains root streams and no sub-streams. Not sure whether this theoretically should be true, but in any case it is not the case in real-world samples.
This is left-over from my initial attempt to parsing ppt documents. Never worked properly.
This can easily be fooled as shown by some malware sample. So, do it the pythonic way: try treating it like a zip file and deal with the exceptions if it is not.
Do not remember potentially huge blobs in memory, need that just for debugging.
Self-made sample that triggers default browser with an URL upon clicking a shape, and that calls calc.exe upon hovering over another shape.
When testing json-output we need to run samples through the "main" functions of modules, not just their "process_file" functions that would accept the extracted and decrypted data from the existing helper function "loop_over_files". They need a filename as input, so add helper to create a temp dir and extract&decrypt samples to that temporarily.
When unzipping into temp dir, we often need to know the original sample name.
In another branch I missed a bug that occurred in one of our test samples. Avoid this by running all tools over all data
christian-intra2net
force-pushed
the
detect-interactive-ppt-features
branch
from
590d905
to
9668cf6
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix behaviour of olevba (i.e. ppt_parser) and oleobj for some real malware samples. Add detection for "new" (actually: very old) type of payload