Merge pull request brad-sp#273 from doomedraven/patch-6

Office publisher package :)

analyzer/windows/lib/core/packages.py

@@ -26,6 +26,8 @@ def choose_package(file_type, file_name, exports):
         return "exe"
     elif "PDF" in file_type or file_name.endswith(".pdf"):
         return "pdf"
+    elif file_name.endswith(".pub"):
+        return "pub"
     elif "Rich Text Format" in file_type or \
             "Microsoft Word" in file_type or \
             "Microsoft Office Word" in file_type or \

analyzer/windows/modules/packages/pub.py

@@ -0,0 +1,55 @@
+# Copyright (C) 2010-2015 Cuckoo Foundation.
+# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
+# See the file 'docs/LICENSE' for copying permission.
+
+from lib.common.abstracts import Package
+
+from _winreg import (OpenKey, CreateKeyEx, SetValueEx, CloseKey, QueryInfoKey, EnumKey,
+        EnumValue, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, KEY_SET_VALUE, KEY_READ,
+        REG_SZ, REG_DWORD)
+
+class PUB(Package):
+    """Word analysis package."""
+    PATHS = [
+        ("ProgramFiles", "Microsoft Office", "MSPUB.EXE"),
+        ("ProgramFiles", "Microsoft Office", "Office*", "MSPUB.EXE"),
+        ("ProgramFiles", "Microsoft Office*", "root", "Office*", "MSPUB.EXE"),
+        ("ProgramFiles", "Microsoft Office", "MSPUB.EXE"),
+    ]
+
+    def set_keys(self):
+
+        baseOfficeKeyPath = r"Software\Microsoft\Office"
+        installedVersions = list()
+        try:
+            officeKey = OpenKey(HKEY_CURRENT_USER, baseOfficeKeyPath, 0, KEY_READ)
+            for currentKey in xrange(0, QueryInfoKey(officeKey)[0]):
+                isVersion = True
+                officeVersion = EnumKey(officeKey, currentKey)
+                if "." in officeVersion:
+                    for intCheck in officeVersion.split("."):
+                        if not intCheck.isdigit():
+                            isVersion = False
+                            break
+
+                    if isVersion:
+                        installedVersions.append(officeVersion)
+            CloseKey(officeKey)
+        except WindowsError:
+                # Office isn't installed at all
+                return
+
+        for oVersion in installedVersions:
+            key = CreateKeyEx(HKEY_CURRENT_USER,
+                      r"{0}\{1}\Publisher\Security".format(baseOfficeKeyPath, oVersion),
+                      0, KEY_SET_VALUE)
+
+            SetValueEx(key, "VBAWarnings", 0, REG_DWORD, 1)
+            SetValueEx(key, "AccessVBOM", 0, REG_DWORD, 1)
+            SetValueEx(key, "ExtensionHardening", 0, REG_DWORD, 0)
+            CloseKey(key)
+
+    def start(self, path):
+         self.set_keys()
+         publisher = self.get_path_glob("Microsoft Office Publisher")
+         return self.execute(publisher, "\"%s\"" % path, path)