OLE VBA

sudo pip install oletools

Supported formats:

    - Word 97-2003 (.doc, .dot), Word 2007+ (.docm, .dotm)

    - Excel 97-2003 (.xls), Excel 2007+ (.xlsm, .xlsb)

    - PowerPoint 97-2003 (.ppt), PowerPoint 2007+ (.pptm, .ppsm)

    - Word/PowerPoint 2007+ XML (aka Flat OPC)

    - Word 2003 XML (.xml)

    - Word/Excel Single File Web Page / MHTML (.mht)

    - Publisher (.pub)

    - SYLK/SLK files (.slk)

    - Text file containing VBA or VBScript source code

    - Password-protected Zip archive containing any of the above

    - raises an error if run with files encrypted using MS Crypto API RC4



Beliebte Posts aus diesem Blog

Shutdown / Lastlogon Analyse

Wer hat das System heruntergefahren: Get-EventLog - LogName system - Source user32 - Newest 1 | fl * Logons der letzten 7 Tage: $filter = @ {     LogName       = 'System'     ProviderName = 'Microsoft-Windows-Winlogon'     StartTime     = ( Get-Date ). AddDays ( -7 ) } $logs = Get-WinEvent - FilterHashtable $filter $res = @ () ForEach ( $log in $logs ) {     if ( $log . Id -eq 7001 ) { $type = "Logon" }     elseif ( $log . Id -eq 7002 ) { $type = "Logoff" }     else { Continue }     # Check if Properties[1] exists before accessing     if ( $log . Properties . Count -gt 1 ) {         try {             $user = ( New-Object System.Security.Principal.SecurityIdentifier $log . Properties [ 1 ]. Value ). Translate ([ System.Security.Principal.NTAccount ])         } catch { ...
Mehr anzeigen