<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" lang="" xml:lang="">
<head>
<meta charset="utf-8" />
<meta name="generator" content="pandoc" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
<title>-</title>
<style>
html {
line-height: 1.5;
font-family: Georgia, serif;
font-size: 20px;
color: #1a1a1a;
background-color: #fdfdfd;
}
body {
margin: 0 auto;
max-width: 36em;
padding-left: 50px;
padding-right: 50px;
padding-top: 50px;
padding-bottom: 50px;
hyphens: auto;
overflow-wrap: break-word;
text-rendering: optimizeLegibility;
font-kerning: normal;
}
@media (max-width: 600px) {
body {
font-size: 0.9em;
padding: 1em;
}
h1 {
font-size: 1.8em;
}
}
@media print {
body {
background-color: transparent;
color: black;
font-size: 12pt;
}
p, h2, h3 {
orphans: 3;
widows: 3;
}
h2, h3, h4 {
page-break-after: avoid;
}
}
p {
margin: 1em 0;
}
a {
color: #1a1a1a;
}
a:visited {
color: #1a1a1a;
}
img {
max-width: 100%;
}
h1, h2, h3, h4, h5, h6 {
margin-top: 1.4em;
}
h5, h6 {
font-size: 1em;
font-style: italic;
}
h6 {
font-weight: normal;
}
ol, ul {
padding-left: 1.7em;
margin-top: 1em;
}
li > ol, li > ul {
margin-top: 0;
}
blockquote {
margin: 1em 0 1em 1.7em;
padding-left: 1em;
border-left: 2px solid #e6e6e6;
color: #606060;
}
code {
font-family: Menlo, Monaco, 'Lucida Console', Consolas, monospace;
font-size: 85%;
margin: 0;
}
pre {
margin: 1em 0;
overflow: auto;
}
pre code {
padding: 0;
overflow: visible;
overflow-wrap: normal;
}
.sourceCode {
background-color: transparent;
overflow: visible;
}
hr {
background-color: #1a1a1a;
border: none;
height: 1px;
margin: 1em 0;
}
table {
margin: 1em 0;
border-collapse: collapse;
width: 100%;
overflow-x: auto;
display: block;
font-variant-numeric: lining-nums tabular-nums;
}
table caption {
margin-bottom: 0.75em;
}
tbody {
margin-top: 0.5em;
border-top: 1px solid #1a1a1a;
border-bottom: 1px solid #1a1a1a;
}
th {
border-top: 1px solid #1a1a1a;
padding: 0.25em 0.5em 0.25em 0.5em;
}
td {
padding: 0.125em 0.5em 0.25em 0.5em;
}
header {
margin-bottom: 4em;
text-align: center;
}
#TOC li {
list-style: none;
}
#TOC ul {
padding-left: 1.3em;
}
#TOC > ul {
padding-left: 0;
}
#TOC a:not(:hover) {
text-decoration: none;
}
code{white-space: pre-wrap;}
span.smallcaps{font-variant: small-caps;}
span.underline{text-decoration: underline;}
div.column{display: inline-block; vertical-align: top; width: 50%;}
div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
ul.task-list{list-style: none;}
.display.math{display: block; text-align: center; margin: 0.5rem auto;}
</style>
</head>
<body>
<h1 id="msodde">msodde</h1>
<p>msodde is a script to parse MS Office documents (e.g. Word, Excel,
RTF, XML), to detect and extract <strong>DDE links</strong> such as
<strong>DDEAUTO</strong>, that have been used to run malicious commands
to deliver malware. It also supports CSV files, which may contain Excel
formulas to run executable files using DDE (technique known as “CSV
injection”). For Word documents, it can extract all the other fields,
and identify suspicious ones.</p>
<p>Supported formats: - Word 97-2003 (.doc, .dot), Word 2007+ (.docx,
.dotx, .docm, .dotm) - Excel 97-2003 (.xls), Excel 2007+ (.xlsx, .xlsm,
.xlsb) - RTF - CSV (exported from / imported into Excel) - XML (exported
from Word 2003, Word 2007+, Excel 2003, Excel 2007+)</p>
<p>For Word documents, msodde detects the use of QUOTE to obfuscate DDE
commands (see <a
href="http://staaldraad.github.io/2017/10/23/msword-field-codes/">this
article</a>), and deobfuscates it automatically.</p>
<p>Special thanks to Christian Herdtweck and Etienne Stalmans, who
contributed large parts of the code.</p>
<p>msodde can be used either as a command-line tool, or as a python
module from your own applications.</p>
<p>It is part of the <a
href="http://www.decalage.info/python/oletools">python-oletools</a>
package.</p>
<h2 id="references-about-dde-exploitation">References about DDE
exploitation</h2>
<ul>
<li>https://www.contextis.com/blog/comma-separated-vulnerabilities</li>
<li>http://www.exploresecurity.com/from-csv-to-cmd-to-qwerty/</li>
<li>https://pwndizzle.blogspot.nl/2017/03/office-document-macros-ole-actions-dde.html</li>
<li>https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/</li>
<li>http://staaldraad.github.io/2017/10/23/msword-field-codes/</li>
<li>https://xorl.wordpress.com/2017/12/11/microsoft-excel-csv-code-execution-injection-method/</li>
<li>http://georgemauer.net/2017/10/07/csv-injection.html</li>
<li>http://blog.7elements.co.uk/2013/01/cell-injection.html</li>
<li>https://appsecconsulting.com/blog/csv-formula-injection</li>
<li>https://www.owasp.org/index.php/CSV_Injection</li>
</ul>
<h2 id="usage">Usage</h2>
<pre class="text"><code>usage: msodde.py [-h] [-j] [--nounquote] [-l LOGLEVEL] [-p PASSWORD] [-d] [-f]
[-a]
FILE
positional arguments:
FILE path of the file to be analyzed
optional arguments:
-h, --help show this help message and exit
-j, --json Output in json format. Do not use with -ldebug
--nounquote don't unquote values
-l LOGLEVEL, --loglevel LOGLEVEL
logging level debug/info/warning/error/critical
(default=warning)
-p PASSWORD, --password PASSWORD
if encrypted office files are encountered, try
decryption with this password. May be repeated.
Filter which OpenXML field commands are returned:
Only applies to OpenXML (e.g. docx) and rtf, not to OLE (e.g. .doc). These
options are mutually exclusive, last option found on command line
overwrites earlier ones.
-d, --dde-only Return only DDE and DDEAUTO fields
-f, --filter Return all fields except harmless ones
-a, --all-fields Return all fields, irrespective of their contents</code></pre>
<p><strong>New in v0.54:</strong> the -p option can now be used to
decrypt encrypted documents using the provided password(s).</p>
<h3 id="examples">Examples</h3>
<p>Scan a single file:</p>
<pre class="text"><code>msodde file.doc</code></pre>
<p>Scan a Word document, extracting <em>all</em> fields:</p>
<pre class="text"><code>msodde -a file.doc</code></pre>
<hr />
<h2 id="how-to-use-msodde-in-python-applications">How to use msodde in
Python applications</h2>
<p>This is work in progress. The API is expected to change in future
versions.</p>
<hr />
<h2 id="python-oletools-documentation">python-oletools
documentation</h2>
<ul>
<li><a href="Home.html">Home</a></li>
<li><a href="License.html">License</a></li>
<li><a href="Install.html">Install</a></li>
<li><a href="Contribute.html">Contribute</a>, Suggest Improvements or
Report Issues</li>
<li>Tools:
<ul>
<li><a href="mraptor.html">mraptor</a></li>
<li><a href="msodde.html">msodde</a></li>
<li><a href="olebrowse.html">olebrowse</a></li>
<li><a href="oledir.html">oledir</a></li>
<li><a href="oleid.html">oleid</a></li>
<li><a href="olemap.html">olemap</a></li>
<li><a href="olemeta.html">olemeta</a></li>
<li><a href="oleobj.html">oleobj</a></li>
<li><a href="oletimes.html">oletimes</a></li>
<li><a href="olevba.html">olevba</a></li>
<li><a href="pyxswf.html">pyxswf</a></li>
<li><a href="rtfobj.html">rtfobj</a></li>
</ul></li>
</ul>
</body>
</html>