diff --git a/README.md b/README.md index 68e9352..eda9b73 100755 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -сф + ``` _|_|_| _| _| _|_| _|_|_| _|_| _|_|_| _|_| @@ -25,10 +25,10 @@ So why not embed XXE payloads in them? That was done by a great [research](http://oxmlxxe.github.io/reveal.js/slides.html#/) by Will Vandevanter (`_will_is`) To create such documents with embedded payloads there is a famous tool called [oxml_xxe](https://github.com/BuffaloWill/oxml_xxe). -But. It is not convinient to use `oxml_xxe` when you need to create hundreds of documents with payloads in different places. +But. It is not convenient to use `oxml_xxe` when you need to create hundreds of documents with payloads in different places. So there it goes - Docem. -It works like that: You specify sample document - that is a doc that has some `magic_symbols` (in illustratuin it is `፨` (in program it is constant `XXCb8bBA9XX`)) that will be replaced by your refernce to a payload in case of XXE payload, or will be replaces by your XSS payload. +It works like that: You specify sample document - that is a doc that has some `magic_symbols` (in illustrations it is marked as `፨` (in program it is constant `XXCb8bBA9XX`)) that will be replaced by your reference to a payload in case of XXE payload, or will be replaces by your XSS payload. Also there are three different types of `payload_type` - every type determine how every `magic_symbol` will be processed for a given file in a document. Every `payload_type` described in section `Usage`. @@ -65,7 +65,7 @@ python3 docem.py --help - optional - `-pt` - payload type - `per_document` - (default mode) for every payload, embed payload in all places in all files and create new doc - - `per_file` - for every payload, for every file inside a docuement, for all places inside file embed payload and create new doc + - `per_file` - for every payload, for every file inside a document, for all places inside file embed payload and create new doc - `per_place` - for every payload, for every place in every file, embed payload and create new doc - `-pf` - payoload file - `-kt` - do not delete temp folders in tmp @@ -74,10 +74,15 @@ python3 docem.py --help Examples ```bash -./docem.py -s samples/xxe/sample_oxml_xxe_mod0/ -pm xss -pf payloads/xss_all.txt -pt per_document -kt -sx docx +./docem.py -s samples/xxe/docx_sample_oxml_xxe_mod0/ -pm xss -pf payloads/xxe_special_6.txt -pt per_document -kt -sx docx +./docem.py -s samples/xxe/docx_sample_oxml_xxe_mod1/ -pm xss -pf payloads/xxe_special_1.txt -pt per_file -kt -sx docx ./docem.py -s samples/xxe/sample_oxml_xxe_mod1.docx -pm xxe -pf payloads/xxe_special_2.txt -kt -pt per_place ./docem.py -s samples/xss_sample_0.odt -pm xss -pf payloads/xss_tiny.txt -pm per_place -./docem.py -s samples/xxe/sample_oxml_xxe_mod0/ -pm xss -pf payloads/xss_all.txt -pt per_file -kt -sx docx +``` + +An equivalent to a `docx` file created by OXML_XXE +``` +./docem.py -s samples/xxe/docx_sample_oxml_xxe_mod0/ -pm xss -pf payloads/xxe_special_6.txt -pt per_document -kt -sx docx ``` @@ -86,7 +91,7 @@ Examples ### Via new file 1. Extract your document `example.docx` -2. Add magic symbols - `፨` (yes, literally - those fancy 5 dots) in places where you want payloads to be embed +2. Add magic symbols - `XXCb8bBA9XX` - (depicted as `፨` in illustrations of this readme) in places where you want payloads to be embed 3. Zip your new sample into `example_modified0.zip` 4. Rename extension - `example_modified0.docx` 5. Use new sample with tool diff --git a/docem.py b/docem.py index 92817f2..79bee8a 100755 --- a/docem.py +++ b/docem.py @@ -429,10 +429,10 @@ def interface_print_logo(): def interface_print_example(): examples = [ - './docem.py -s samples/xxe/sample_oxml_xxe_mod0/ -pm xss -pf payloads/xss_all.txt -pt per_document -kt -sx docx', + './docem.py -s samples/xxe/docx_sample_oxml_xxe_mod0/ -pm xss -pf payloads/xxe_special_6.txt -pt per_document -kt -sx docx', + './docem.py -s samples/xxe/docx_sample_oxml_xxe_mod1/ -pm xss -pf payloads/xxe_special_1.txt -pt per_file -kt -sx docx', './docem.py -s samples/xxe/sample_oxml_xxe_mod1.docx -pm xxe -pf payloads/xxe_special_2.txt -kt -pt per_place', - './docem.py -s samples/xss_sample_0.odt -pm xss -pf payloads/xss_tiny.txt -pm per_place', - './docem.py -s samples/xxe/sample_oxml_xxe_mod0/ -pm xss -pf payloads/xss_all.txt -pt per_file -kt -sx docx' + './docem.py -s samples/xss_sample_0.odt -pm xss -pf payloads/xss_tiny.txt -pm per_place' ] print('Examples:\n%s\n' % '\n'.join(e for e in examples)) @@ -487,13 +487,13 @@ def interface_print_example(): os.mkdir(paths["path_to_tmp"]) print('\n=========== Current setup ===========') - print('sample file:\t\t',args.sample) - print('sample is it dir:\t',paths['sample_type_is_folder']) + print('sample file path:\t\t',args.sample) + print('sample is a directory:\t',paths['sample_type_is_folder']) print('payload mode:\t\t',args.payload_mode) print('payload file:\t\t',args.payload_file) print('payload type:\t\t',args.payload_type) print('number of payloads:\t',len(payloads)) - print('keep upacked files:\t',args.keep_tmp) + print('keep unpacked files:\t',args.keep_tmp) document_unpack(paths) tree = document_tree_generate(paths) diff --git a/payloads/xxe_special_6.txt b/payloads/xxe_special_6.txt new file mode 100755 index 0000000..c325719 --- /dev/null +++ b/payloads/xxe_special_6.txt @@ -0,0 +1,5 @@ +{"vector":"]>","reference":"&xxe_canary_0;"} +{"vector":"]>","reference":"&xxe_canary_4;"} +{"vector":"]>","reference":"&xxe_canary_5;"} +{"vector":"%dtd;%trick;]> ]>","reference":""} +{"vector":"]>","reference":"&xxe_canary_7;"} \ No newline at end of file diff --git a/pics/screenshot.png b/pics/screenshot.png index b54d1f1..5bb673f 100755 Binary files a/pics/screenshot.png and b/pics/screenshot.png differ diff --git a/samples/xxe/sample_oxml_xxe/[Content_Types].xml b/samples/xxe/docx_sample_oxml_xxe/[Content_Types].xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/[Content_Types].xml rename to samples/xxe/docx_sample_oxml_xxe/[Content_Types].xml diff --git a/samples/xxe/sample_oxml_xxe/_rels/.rels b/samples/xxe/docx_sample_oxml_xxe/_rels/.rels similarity index 100% rename from samples/xxe/sample_oxml_xxe/_rels/.rels rename to samples/xxe/docx_sample_oxml_xxe/_rels/.rels diff --git a/samples/xxe/sample_oxml_xxe/docProps/app.xml b/samples/xxe/docx_sample_oxml_xxe/docProps/app.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/docProps/app.xml rename to samples/xxe/docx_sample_oxml_xxe/docProps/app.xml diff --git a/samples/xxe/sample_oxml_xxe/docProps/core.xml b/samples/xxe/docx_sample_oxml_xxe/docProps/core.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/docProps/core.xml rename to samples/xxe/docx_sample_oxml_xxe/docProps/core.xml diff --git a/samples/xxe/sample_oxml_xxe/word/_rels/document.xml.rels b/samples/xxe/docx_sample_oxml_xxe/word/_rels/document.xml.rels similarity index 100% rename from samples/xxe/sample_oxml_xxe/word/_rels/document.xml.rels rename to samples/xxe/docx_sample_oxml_xxe/word/_rels/document.xml.rels diff --git a/samples/xxe/sample_oxml_xxe/word/document.xml b/samples/xxe/docx_sample_oxml_xxe/word/document.xml similarity index 68% rename from samples/xxe/sample_oxml_xxe/word/document.xml rename to samples/xxe/docx_sample_oxml_xxe/word/document.xml index af2ecdc..7d88552 100755 --- a/samples/xxe/sample_oxml_xxe/word/document.xml +++ b/samples/xxe/docx_sample_oxml_xxe/word/document.xml @@ -1,2 +1,2 @@ - -Sample§ Replace1 \ No newline at end of file + +SampleXXCb8bBA9XXXXCb8bBA9XX \ No newline at end of file diff --git a/samples/xxe/sample_oxml_xxe/word/fontTable.xml b/samples/xxe/docx_sample_oxml_xxe/word/fontTable.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/word/fontTable.xml rename to samples/xxe/docx_sample_oxml_xxe/word/fontTable.xml diff --git a/samples/xxe/sample_oxml_xxe/word/settings.xml b/samples/xxe/docx_sample_oxml_xxe/word/settings.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/word/settings.xml rename to samples/xxe/docx_sample_oxml_xxe/word/settings.xml diff --git a/samples/xxe/sample_oxml_xxe/word/styles.xml b/samples/xxe/docx_sample_oxml_xxe/word/styles.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/word/styles.xml rename to samples/xxe/docx_sample_oxml_xxe/word/styles.xml diff --git a/samples/xxe/sample_oxml_xxe/word/stylesWithEffects.xml b/samples/xxe/docx_sample_oxml_xxe/word/stylesWithEffects.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/word/stylesWithEffects.xml rename to samples/xxe/docx_sample_oxml_xxe/word/stylesWithEffects.xml diff --git a/samples/xxe/sample_oxml_xxe/word/theme/theme1.xml b/samples/xxe/docx_sample_oxml_xxe/word/theme/theme1.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/word/theme/theme1.xml rename to samples/xxe/docx_sample_oxml_xxe/word/theme/theme1.xml diff --git a/samples/xxe/sample_oxml_xxe/word/webSettings.xml b/samples/xxe/docx_sample_oxml_xxe/word/webSettings.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe/word/webSettings.xml rename to samples/xxe/docx_sample_oxml_xxe/word/webSettings.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/[Content_Types].xml b/samples/xxe/docx_sample_oxml_xxe_mod0/[Content_Types].xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/[Content_Types].xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/[Content_Types].xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/_rels/.rels b/samples/xxe/docx_sample_oxml_xxe_mod0/_rels/.rels similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/_rels/.rels rename to samples/xxe/docx_sample_oxml_xxe_mod0/_rels/.rels diff --git a/samples/xxe/sample_oxml_xxe_mod0/docProps/app.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/docProps/app.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/docProps/app.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/docProps/app.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/docProps/core.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/docProps/core.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/docProps/core.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/docProps/core.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/_rels/document.xml.rels b/samples/xxe/docx_sample_oxml_xxe_mod0/word/_rels/document.xml.rels similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/_rels/document.xml.rels rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/_rels/document.xml.rels diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/document.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/word/document.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/document.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/document.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/fontTable.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/word/fontTable.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/fontTable.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/fontTable.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/settings.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/word/settings.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/settings.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/settings.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/styles.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/word/styles.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/styles.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/styles.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/stylesWithEffects.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/word/stylesWithEffects.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/stylesWithEffects.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/stylesWithEffects.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/theme/theme1.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/word/theme/theme1.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/theme/theme1.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/theme/theme1.xml diff --git a/samples/xxe/sample_oxml_xxe_mod0/word/webSettings.xml b/samples/xxe/docx_sample_oxml_xxe_mod0/word/webSettings.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod0/word/webSettings.xml rename to samples/xxe/docx_sample_oxml_xxe_mod0/word/webSettings.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/[Content_Types].xml b/samples/xxe/docx_sample_oxml_xxe_mod1/[Content_Types].xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/[Content_Types].xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/[Content_Types].xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/_rels/.rels b/samples/xxe/docx_sample_oxml_xxe_mod1/_rels/.rels similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/_rels/.rels rename to samples/xxe/docx_sample_oxml_xxe_mod1/_rels/.rels diff --git a/samples/xxe/sample_oxml_xxe_mod1/docProps/app.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/docProps/app.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/docProps/app.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/docProps/app.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/docProps/core.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/docProps/core.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/docProps/core.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/docProps/core.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/_rels/document.xml.rels b/samples/xxe/docx_sample_oxml_xxe_mod1/word/_rels/document.xml.rels similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/_rels/document.xml.rels rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/_rels/document.xml.rels diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/document.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/word/document.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/document.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/document.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/fontTable.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/word/fontTable.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/fontTable.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/fontTable.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/settings.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/word/settings.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/settings.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/settings.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/styles.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/word/styles.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/styles.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/styles.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/stylesWithEffects.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/word/stylesWithEffects.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/stylesWithEffects.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/stylesWithEffects.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/theme/theme1.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/word/theme/theme1.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/theme/theme1.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/theme/theme1.xml diff --git a/samples/xxe/sample_oxml_xxe_mod1/word/webSettings.xml b/samples/xxe/docx_sample_oxml_xxe_mod1/word/webSettings.xml similarity index 100% rename from samples/xxe/sample_oxml_xxe_mod1/word/webSettings.xml rename to samples/xxe/docx_sample_oxml_xxe_mod1/word/webSettings.xml diff --git a/samples/xxe/xlsx_created_in_wps2.xlsx b/samples/xxe/xlsx_created_in_wps2.xlsx new file mode 100644 index 0000000..28b1949 Binary files /dev/null and b/samples/xxe/xlsx_created_in_wps2.xlsx differ diff --git a/samples/xxe/xlsx_created_in_wps2.zip b/samples/xxe/xlsx_created_in_wps2.zip new file mode 100644 index 0000000..28b1949 Binary files /dev/null and b/samples/xxe/xlsx_created_in_wps2.zip differ diff --git a/samples/xxe/xlsx_created_in_wps2_basic/[Content_Types].xml b/samples/xxe/xlsx_created_in_wps2_basic/[Content_Types].xml new file mode 100644 index 0000000..875bf1f --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/[Content_Types].xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/_rels/.rels b/samples/xxe/xlsx_created_in_wps2_basic/_rels/.rels new file mode 100644 index 0000000..ac98ae2 --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/_rels/.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/docProps/app.xml b/samples/xxe/xlsx_created_in_wps2_basic/docProps/app.xml new file mode 100644 index 0000000..161b2e0 --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/docProps/app.xml @@ -0,0 +1,2 @@ + +WPS Spreadsheets工作表1Sheet1 \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/docProps/core.xml b/samples/xxe/xlsx_created_in_wps2_basic/docProps/core.xml new file mode 100644 index 0000000..04514db --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/docProps/core.xml @@ -0,0 +1,2 @@ + +testtest2020-07-05T12:18:39Z2020-07-05T12:20:09Z \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/docProps/custom.xml b/samples/xxe/xlsx_created_in_wps2_basic/docProps/custom.xml new file mode 100644 index 0000000..a52c2fc --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/docProps/custom.xml @@ -0,0 +1,2 @@ + +1033-11.1.0.8722 \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/xl/_rels/workbook.xml.rels b/samples/xxe/xlsx_created_in_wps2_basic/xl/_rels/workbook.xml.rels new file mode 100644 index 0000000..9b37021 --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/xl/_rels/workbook.xml.rels @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/xl/sharedStrings.xml b/samples/xxe/xlsx_created_in_wps2_basic/xl/sharedStrings.xml new file mode 100644 index 0000000..4ef9787 --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/xl/sharedStrings.xml @@ -0,0 +1,2 @@ + +XXCb8bBA9XXcol2XXCb8bBA9XXdata2 \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/xl/styles.xml b/samples/xxe/xlsx_created_in_wps2_basic/xl/styles.xml new file mode 100644 index 0000000..a4d22f6 --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/xl/styles.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/xl/theme/theme1.xml b/samples/xxe/xlsx_created_in_wps2_basic/xl/theme/theme1.xml new file mode 100644 index 0000000..0143017 --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/xl/theme/theme1.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/xl/workbook.xml b/samples/xxe/xlsx_created_in_wps2_basic/xl/workbook.xml new file mode 100644 index 0000000..0f7b97e --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/xl/workbook.xml @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/samples/xxe/xlsx_created_in_wps2_basic/xl/worksheets/sheet1.xml b/samples/xxe/xlsx_created_in_wps2_basic/xl/worksheets/sheet1.xml new file mode 100644 index 0000000..dc0b7ba --- /dev/null +++ b/samples/xxe/xlsx_created_in_wps2_basic/xl/worksheets/sheet1.xml @@ -0,0 +1,2 @@ + +0123 \ No newline at end of file