Microsoft Office add-in detection #966

twiggler · 2024-12-05T12:41:56Z

Detects:

Persistence through startup folders (templates, executables)
COM addins
VSTO addins by parsing ClickOnce Deployment manifests
Web addins by inspecting WEF cache and parsing manifests

Limitations:

Office for Mac is not supported
Supports Microsoft Office 2016 and later
Manifests which are wof compressed are unreadable

Bonus:

Fix issue in resolver where user environment was not taken into account when expanding paths
Fix issue where partial path resolution resolved to directories.
Added convenience functions for querying registry

codecov · 2024-12-05T12:47:30Z

Codecov Report

Attention: Patch coverage is 89.51965% with 24 lines in your changes missing coverage. Please review.

Project coverage is 77.85%. Comparing base (6770095) to head (97a57f4).
Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
...ssect/target/plugins/apps/productivity/msoffice.py	87.36%	24 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #966      +/-   ##
==========================================
+ Coverage   77.72%   77.85%   +0.13%     
==========================================
  Files         326      328       +2     
  Lines       28571    28863     +292     
==========================================
+ Hits        22206    22472     +266     
- Misses       6365     6391      +26

Flag	Coverage Δ
unittests	`77.85% <89.51%> (+0.13%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Schamper · 2024-12-05T14:50:52Z

dissect/target/helpers/regutil.py

@@ -172,6 +172,18 @@ def value(self, value: str) -> RegistryValue:
        """
        raise NotImplementedError()

+    def value_or_default(self, value: str, default: ValueType = None) -> RegistryValue:


Can you roll this into the value method so it's more in line with standard library Python code?

dissect/target/helpers/utils.py

Schamper · 2024-12-05T14:51:56Z

dissect/target/plugins/os/windows/registry.py

    @internal
    def value(self, key: str, value: str) -> ValueCollection:
        """Convenience method for accessing a specific value."""
        return self.key(key).value(value)

+    @internal
+    def value_or_empty(self, key: str, value: str) -> ValueCollection:


Schamper · 2024-12-05T14:52:08Z

dissect/target/plugins/os/windows/registry.py

@@ -282,11 +286,31 @@ def key(self, key: Optional[str] = None) -> KeyCollection:

        return res

+    @internal
+    def key_or_empty(self, key: Optional[str] = None) -> KeyCollection:


Same with this one.

twiggler · 2024-12-05T15:37:41Z

dissect/target/helpers/utils.py

@@ -29,17 +29,20 @@ def findall(buf: bytes, needle: bytes) -> Iterator[int]:
 T = TypeVar("T")


-def to_list(value: T | list[T]) -> list[T]:
-    """Convert a single value or a list of values to a list.
+def to_list(value: T | list[T] | None) -> list[T]:


To Miauwkeru: For our usecases, your implementation won in the end.

dissect/target/plugins/apps/productivity/msoffice.py

Horofic · 2025-01-14T13:27:36Z

dissect/target/plugins/os/windows/registry.py

@@ -299,10 +303,10 @@ def iterkeys(self, keys: Union[str, list[str]]) -> Iterator[KeyCollection]:
            yield key

    @internal
-    def keys(self, keys: Union[str, list[str]]) -> Iterator[KeyCollection]:
+    def keys(self, keys: Union[str, list[str]]) -> Iterator[RegistryKey]:


Suggested change

def keys(self, keys: Union[str, list[str]]) -> Iterator[RegistryKey]:

def keys(self, keys: str | list[str]) -> Iterator[RegistryKey]:

Horofic · 2025-01-14T13:28:00Z

dissect/target/plugins/os/windows/registry.py

@@ -316,6 +320,19 @@ def keys(self, keys: Union[str, list[str]]) -> Iterator[KeyCollection]:
            except HiveUnavailableError:
                pass

+    @internal
+    def values(self, keys: Union[str, list[str]], value: str) -> Iterator[RegistryValue]:


Suggested change

def values(self, keys: Union[str, list[str]], value: str) -> Iterator[RegistryValue]:

def values(self, keys: str | list[str], value: str) -> Iterator[RegistryValue]:

tests/plugins/filesystem/test_resolver.py

dissect/target/plugins/apps/productivity/msoffice.py

Horofic · 2025-01-14T13:42:35Z

dissect/target/plugins/apps/productivity/msoffice.py

+            - https://learn.microsoft.com/en-us/office/dev/add-ins/overview/office-add-ins
+            - https://learn.microsoft.com/en-us/visualstudio/vsto/registry-entries-for-vsto-add-ins
+
+        Yields a OfficeNativeAddinRecord with fields:


Suggested change

Yields a OfficeNativeAddinRecord with fields:

Yields a ``OfficeNativeAddinRecord`` with fields:

I think this one was already processed?

dissect/target/plugins/apps/productivity/msoffice.py

Schamper · 2025-01-15T09:52:55Z

dissect/target/helpers/regutil.py

+        except RegistryValueNotFoundError:
+            if default is self.__marker:
+                raise
+            return VirtualValue(VirtualHive(), value, default)


Wouldn't we still want the actual hive to be linked?

Schamper · 2025-01-15T09:53:56Z

dissect/target/loaders/cb.py

@@ -161,7 +161,7 @@ def subkey(self, subkey: str) -> CbRegistryKey:
    def subkeys(self) -> list[CbRegistryKey]:
        return list(map(self.subkey, self.data["sub_keys"]))

-    def value(self, value: str) -> str:
+    def _value(self, value: str) -> str:


Maybe update these return types while we're at it?

I love types, so happy to do it.

But is there light at the end of the tunnel?

Unfortunately, a lot of the type annotations are incorrect. As I am used to inferring the behavior of a function by its type signature, this has put me on the wrong foot on multiple occasions. The type annotations are incorrect because the code is not type checked, either in CI or locally. I think one of the problems with enforcing type checking is that core dependencies such as flow record and cstruct use dynamic typing.
I believe @Miauwkeru mentioned a solution for somehow adding type information to cstruct. Or we could use code generation at "compile-time" instead of during run-time.

Happy to help out with this (also in my own time). However, I also think a principled decision needs to be made to stop relying on techniques which use dynamic types.

The .pyi generation for cstruct was indeed my idea, of which Miauwkeru made a POC. Happy to hear other suggestions of yours.

However, 95% of code in dissect.target does not interact with flow.record or dissect.cstruct, and we still want accurate type information there. I agree that it's best if we can check that in CI or locally. So I think the best way forward for the time being is to figure out if there's some way to do that and ignore all flow.record and dissect.cstruct types while we work separately on a solution for those dynamic types.

(I take it the return type can be covariant?)

Schamper · 2025-01-15T09:54:04Z

dissect/target/loaders/smb.py

@@ -308,7 +308,7 @@ def subkeys(self) -> list[SmbRegistryKey]:

        return subkeys

-    def value(self, value: str) -> str:
+    def _value(self, value: str) -> str:


Maybe update these return types while we're at it?

dissect/target/plugins/apps/productivity/msoffice.py

Horofic · 2025-01-29T10:10:42Z

dissect/target/helpers/utils.py

-    if not isinstance(value, list):
+    if value is None:
+        return []
+    elif not isinstance(value, list):


Suggested change

elif not isinstance(value, list):

if not isinstance(value, list):

Horofic · 2025-01-29T10:14:53Z

dissect/target/plugins/apps/productivity/msoffice.py

+                nativePluginStatus = self._parse_plugin_status(addin)
+                yield OfficeNativeAddinRecord(
+                    name=addin.value("FriendlyName", None).value,
+                    modification_time=addin.timestamp,
+                    loaded=nativePluginStatus.loaded if nativePluginStatus else None,
+                    load_behavior=nativePluginStatus.load_behavior.name if nativePluginStatus else None,
+                    type=addin_type,
+                    manifest=windows_path(manifest_path_str) if manifest_path_str else None,
+                    codebases=executables,
+                )


Any reason this is not snake cased?

Suggested change

nativePluginStatus = self._parse_plugin_status(addin)

yield OfficeNativeAddinRecord(

name=addin.value("FriendlyName", None).value,

modification_time=addin.timestamp,

loaded=nativePluginStatus.loaded if nativePluginStatus else None,

load_behavior=nativePluginStatus.load_behavior.name if nativePluginStatus else None,

type=addin_type,

manifest=windows_path(manifest_path_str) if manifest_path_str else None,

codebases=executables,

)

native_plugin_status = self._parse_plugin_status(addin)

yield OfficeNativeAddinRecord(

name=addin.value("FriendlyName", None).value,

modification_time=addin.timestamp,

loaded=native_plugin_status.loaded if nativePluginStatus else None,

load_behavior=native_plugin_status.load_behavior.name if native_plugin_status else None,

type=addin_type,

manifest=windows_path(manifest_path_str) if manifest_path_str else None,

codebases=executables,

)

…s (?)

- fix regression in web plugin name

- cache office component root dirs

twiggler force-pushed the office-addins branch from 16bdf78 to 805ab29 Compare December 5, 2024 12:43

twiggler force-pushed the office-addins branch 3 times, most recently from 95ab63d to d55a0c4 Compare December 5, 2024 13:29

Schamper requested changes Dec 5, 2024

View reviewed changes

twiggler force-pushed the office-addins branch 4 times, most recently from 6338cec to 755f6cf Compare December 5, 2024 15:26

twiggler commented Dec 5, 2024

View reviewed changes

twiggler marked this pull request as ready for review December 5, 2024 15:39

twiggler requested review from Miauwkeru and Horofic December 6, 2024 07:14

Horofic requested changes Dec 12, 2024

View reviewed changes

EinatFox linked an issue Dec 16, 2024 that may be closed by this pull request

Add plugin for Office addins #616

Open

twiggler force-pushed the office-addins branch 4 times, most recently from 375faea to 951e4e3 Compare January 7, 2025 13:34

twiggler requested a review from Horofic January 8, 2025 08:39

Horofic requested changes Jan 14, 2025

View reviewed changes

Schamper requested changes Jan 15, 2025

View reviewed changes

twiggler force-pushed the office-addins branch from 7439492 to 97a57f4 Compare January 23, 2025 12:33

twiggler requested a review from Horofic January 23, 2025 15:56

Horofic requested changes Jan 29, 2025

View reviewed changes

twiggler added 4 commits January 29, 2025 13:28

Add msoffice productivity plugin

823f79f

address peer review comments

3e62b8e

Conform to python interface patterns regarding defaults and exception…

f49b195

…s (?)

refactor: bind manifest parser to manifest file

aa08eef

twiggler added 15 commits January 29, 2025 13:28

feature: parse both loading state and load behavior

484d230

refactor: Make parser pure

48d48be

fix: update unit tests

9d9cdd3

- fix regression in web plugin name

feature: add modification date

c63a167

fix: Do not parse elusive .metadata files

776e918

doc: document msoffice plugin functions

3eb83d0

refactor: type marker.

4fff7f9

- cache office component root dirs

refactor: remove value_or_empty which is no longer used

5d9e871

review: small typos

97f5566

fix: annotation for None keys

0d8faca

fix: add typings to test_resolver

16aa9c4

fix: set registry hive

bae7457

fix: update types in cb

4e94df0

Fix typings smb

0005fca

fix: minor comments

d3ec8e4

twiggler force-pushed the office-addins branch from 7888515 to d3ec8e4 Compare January 29, 2025 12:29

twiggler requested a review from Horofic January 29, 2025 12:51

Horofic approved these changes Jan 29, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Microsoft Office add-in detection #966

Microsoft Office add-in detection #966

twiggler commented Dec 5, 2024 •

edited

Loading

codecov bot commented Dec 5, 2024 •

edited

Loading

Schamper Dec 5, 2024

Schamper Dec 5, 2024

Schamper Dec 5, 2024

twiggler Dec 5, 2024 •

edited

Loading

Horofic Jan 14, 2025

Horofic Jan 29, 2025

Horofic Jan 14, 2025

Horofic Jan 29, 2025

Horofic Jan 14, 2025

Horofic Jan 29, 2025

twiggler Jan 29, 2025

Schamper Jan 15, 2025

Schamper Jan 15, 2025

twiggler Jan 16, 2025

Schamper Jan 16, 2025

twiggler Jan 23, 2025

Schamper Jan 15, 2025

Horofic Jan 29, 2025

Horofic Jan 29, 2025

	def keys(self, keys: Union[str, list[str]]) -> Iterator[RegistryKey]:
	def keys(self, keys: str \| list[str]) -> Iterator[RegistryKey]:

	def values(self, keys: Union[str, list[str]], value: str) -> Iterator[RegistryValue]:
	def values(self, keys: str \| list[str], value: str) -> Iterator[RegistryValue]:

	Yields a OfficeNativeAddinRecord with fields:
	Yields a ``OfficeNativeAddinRecord`` with fields:

	elif not isinstance(value, list):
	if not isinstance(value, list):

Microsoft Office add-in detection #966

Are you sure you want to change the base?

Microsoft Office add-in detection #966

Conversation

twiggler commented Dec 5, 2024 • edited Loading

codecov bot commented Dec 5, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

twiggler Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

twiggler commented Dec 5, 2024 •

edited

Loading

codecov bot commented Dec 5, 2024 •

edited

Loading

twiggler Dec 5, 2024 •

edited

Loading