Jump to content

Guest, which answer was the most helpful?

If any of these replies answered your question, please take a moment to click the 'Mark as solution' button on the post with the best answer.
Marking posts as the solution will help other community members find answers to their questions quickly. Thank you for your help!

Featured Replies

Posted

Hi All,

 

Does anyone know of a tool or technique for detecting if an MSOffice

document of any type contains macros or if there is a command line tool

that will list the macros within a document?

 

TIA,

 

Boggy

What has this to do with security?

 

"Bogwitch" <Bogwitch@reply.to.group.fake> wrote in message

news:tZcji.6015$oa7.1176@newsfe1-gui.ntli.net...

> Hi All,

>

> Does anyone know of a tool or technique for detecting if an MSOffice

> document of any type contains macros or if there is a command line tool

> that will list the macros within a document?

>

> TIA,

>

> Boggy

"Bogwitch" <Bogwitch@reply.to.group.fake> wrote...

>Does anyone know of a tool or technique for detecting if an MSOffice

>document of any type contains macros or if there is a command line tool

>that will list the macros within a document?

 

Dunno about the other document types, but if an UNENCRYPTED Excel workbook

contains general VBA modules, the workbook will contain an ASCII text string

that begins with "Module=". The names of any event handlers will also appear

as ASCII text strings, e.g., Workbook_Open.

 

You'd need a string lister, such as the strings.exe command found in the GNU

binutils package. Check the MinGW32 Project site or the DJGPP site for

binutils.

Jerry wrote:

> What has this to do with security?

>

> "Bogwitch" <Bogwitch@reply.to.group.fake> wrote in message

> news:tZcji.6015$oa7.1176@newsfe1-gui.ntli.net...

>> Hi All,

>>

>> Does anyone know of a tool or technique for detecting if an MSOffice

>> document of any type contains macros or if there is a command line tool

>> that will list the macros within a document?

>>

>> TIA,

>>

>> Boggy

 

Jerry,

 

When I am performing an in-depth sweep of a customers site, it would be

useful for me to differentiate between documents that contain macros and

those that don't. Those that do not contain macros require little

investigation, those that do contain macros will need the macros

examining to ensure there is no unwanted action performed my the macro.

 

HTH,

 

Boggy.

 

--

Posted via a free Usenet account from http://www.teranews.com

Harlan Grove wrote:

> "Bogwitch" <Bogwitch@reply.to.group.fake> wrote...

>> Does anyone know of a tool or technique for detecting if an MSOffice

>> document of any type contains macros or if there is a command line tool

>> that will list the macros within a document?

>

> Dunno about the other document types, but if an UNENCRYPTED Excel workbook

> contains general VBA modules, the workbook will contain an ASCII text string

> that begins with "Module=". The names of any event handlers will also appear

> as ASCII text strings, e.g., Workbook_Open.

>

> You'd need a string lister, such as the strings.exe command found in the GNU

> binutils package. Check the MinGW32 Project site or the DJGPP site for

> binutils.

 

Thanks Harlan,

 

Yes, the use of strings could be useful but I suspect it is *possible*

to find the string 'Module=' elsewhere in a document. What I would like

to see is a way of detecting, perhaps via a bytecode signature, the

existence of a macro and ideally it's name.

 

Thanks for the infor re: Excel - I think my best bet might be to create

or gather a few samples and have a good play....

 

Boggy.

 

--

Posted via a free Usenet account from http://www.teranews.com

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...