Implement oletools to filter out bad macros
Florent Daigniere
2 years ago
parent
9c6e9b05db
commit
3e45a791cf
@ -0,0 +1,31 @@
|
||||
# syntax=docker/dockerfile-upstream:1.4.3
|
||||
|
||||
# oletools image
|
||||
FROM base
|
||||
|
||||
ARG VERSION=local
|
||||
LABEL version=$VERSION
|
||||
|
||||
RUN set -euxo pipefail \
|
||||
; apk add --no-cache netcat-openbsd libmagic libffi \
|
||||
; curl -sLo olefy.py https://raw.githubusercontent.com/HeinleinSupport/olefy/f8aac6cc55283886d153e89c8f27fae66b1c24e2/olefy.py \
|
||||
; chmod 755 olefy.py
|
||||
|
||||
RUN echo $VERSION >/version
|
||||
|
||||
HEALTHCHECK --start-period=60s CMD echo PING|nc -q1 127.0.0.1 11343|grep "PONG"
|
||||
EXPOSE 11343/tcp
|
||||
|
||||
USER nobody:nobody
|
||||
|
||||
ENV \
|
||||
OLEFY_BINDADDRESS="0.0.0.0" \
|
||||
OLEFY_BINDPORT="11343" \
|
||||
OLEFY_OLEVBA_PATH="/app/venv/bin/olevba" \
|
||||
OLEFY_PYTHON_PATH="/app/venv/bin/python3" \
|
||||
OLEFY_TMPDIR="/dev/shm/" \
|
||||
OLEFY_MINLENGTH="300" \
|
||||
OLEFY_DEL_TMP="1" \
|
||||
OLEFY_DEL_TMP_FAILED="1"
|
||||
|
||||
CMD /app/olefy.py
|
||||
@ -0,0 +1,12 @@
|
||||
OLETOOLS_MACRO_MRAPTOR {
|
||||
expression = "(OLETOOLS_A & OLETOOLS_W) | (OLETOOLS_A & OLETOOLS_X) | (OLETOOLS_W & OLETOOLS_X)";
|
||||
message = "Rejected (malicious macro - mraptor)";
|
||||
policy = "leave";
|
||||
score = 20.0;
|
||||
}
|
||||
OLETOOLS_MACRO_SUSPICIOUS {
|
||||
expression = "OLETOOLS & OLETOOLS_SUSPICIOUS";
|
||||
message = "Rejected (malicious macro)";
|
||||
policy = "leave";
|
||||
score = 20.0;
|
||||
}
|
||||
@ -0,0 +1,61 @@
|
||||
oletools {
|
||||
# default olefy settings
|
||||
servers = "{{ OLETOOLS_ADDRESS }}"
|
||||
|
||||
# needs to be set explicitly for Rspamd < 1.9.5
|
||||
scan_mime_parts = true;
|
||||
extended = true;
|
||||
max_size = 3145728;
|
||||
timeout = 20.0;
|
||||
retransmits = 1;
|
||||
|
||||
patterns {
|
||||
OLETOOLS_MACRO = '^.....M..$';
|
||||
OLETOOLS_AUTOEXEC = '^A....M..$';
|
||||
OLETOOLS_SUSPICIOUS = '^.....MS.$';
|
||||
# see https://github.com/decalage2/oletools/blob/master/oletools/mraptor.py
|
||||
OLETOOLS_A = '(?i)\b(?:Auto(?:Exec|_?Open|_?Close|Exit|New)|Document(?:_?Open|_Close|_?BeforeClose|Change|_New)|NewDocument|Workbook(?:_Open|_Activate|_Close|_BeforeClose)|\w+_(?:Painted|Painting|GotFocus|LostFocus|MouseHover|Layout|Click|Change|Resize|BeforeNavigate2|BeforeScriptExecute|DocumentComplete|DownloadBegin|DownloadComplete|FileDownload|NavigateComplete2|NavigateError|ProgressChange|PropertyChange|SetSecureLockIcon|StatusTextChange|TitleChange|MouseMove|MouseEnter|MouseLeave|OnConnecting))|Auto_Ope\b';
|
||||
OLETOOLS_W = '(?i)\b(?:FileCopy|CopyFile|Kill|CreateTextFile|VirtualAlloc|RtlMoveMemory|URLDownloadToFileA?|AltStartupPath|WriteProcessMemory|ADODB\.Stream|WriteText|SaveToFile|SaveAs|SaveAsRTF|FileSaveAs|MkDir|RmDir|SaveSetting|SetAttr)\b|(?:\bOpen\b[^\n]+\b(?:Write|Append|Binary|Output|Random)\b)';
|
||||
OLETOOLS_X = '(?i)\b(?:Shell|CreateObject|GetObject|SendKeys|RUN|CALL|MacScript|FollowHyperlink|CreateThread|ShellExecuteA?|ExecuteExcel4Macro|EXEC|REGISTER|SetTimer)\b|(?:\bDeclare\b[^\n]+\bLib\b)';
|
||||
}
|
||||
|
||||
# mime-part regex matching in content-type or filename
|
||||
mime_parts_filter_regex {
|
||||
#UNKNOWN = "application\/octet-stream";
|
||||
DOC2 = "application\/msword";
|
||||
DOC3 = "application\/vnd\.ms-word.*";
|
||||
XLS = "application\/vnd\.ms-excel.*";
|
||||
PPT = "application\/vnd\.ms-powerpoint.*";
|
||||
GENERIC = "application\/vnd\.openxmlformats-officedocument.*";
|
||||
}
|
||||
# mime-part filename extension matching (no regex)
|
||||
mime_parts_filter_ext {
|
||||
doc = "doc";
|
||||
dot = "dot";
|
||||
docx = "docx";
|
||||
dotx = "dotx";
|
||||
docm = "docm";
|
||||
dotm = "dotm";
|
||||
xls = "xls";
|
||||
xlt = "xlt";
|
||||
xla = "xla";
|
||||
xlsx = "xlsx";
|
||||
xltx = "xltx";
|
||||
xlsm = "xlsm";
|
||||
xltm = "xltm";
|
||||
xlam = "xlam";
|
||||
xlsb = "xlsb";
|
||||
ppt = "ppt";
|
||||
pot = "pot";
|
||||
pps = "pps";
|
||||
ppa = "ppa";
|
||||
pptx = "pptx";
|
||||
potx = "potx";
|
||||
ppsx = "ppsx";
|
||||
ppam = "ppam";
|
||||
pptm = "pptm";
|
||||
potm = "potm";
|
||||
ppsm = "ppsm";
|
||||
slk = "slk";
|
||||
}
|
||||
}
|
||||
@ -0,0 +1 @@
|
||||
Implement OLETools and block bad macros in office documents
|
||||
Loading…
Reference in New Issue