rtfexploit_extract.py

# rtfexploit_extract.py
#
# @cyberclues
# ref: http://blog.malwareclipboard.com/2015/10/rtf-exploit-document-extraction.html
#
# 2015/10/22
# Updated to support multiple input files

import struct
import sys
import os
import argparse


def find_marker(fileref, marker, count):
	sect = 1
	while sect:
		sect = fileref.read(1)
		if sect == marker:
			for i in xrange(count-1):
				nextb = fileref.read(1)
				if nextb != marker:
					break
				else:
					if i == count-2:
						return fileref.tell()
	return ""
						
def xor(data, key):
	l = len(key)
	return bytearray(( (data[i] ^ key[i % l]) for i in range(0,len(data))))

def xorb(data,key):
	l = len(key)
	decodedbuff=bytearray()
	for i in range(0,len(data),4):
		if data[i:i+4] == bytearray([0x0,0x0,0x0,0x0]):
			decodedbuff[i:i+4]= bytearray([0x0,0x0,0x0,0x0])
		else:
			decodedbuff[i:i+4] = xor(data[i:i+4],key)
	return decodedbuff




parser = argparse.ArgumentParser(description='Extract encrypted payload and decoy document from CVE-2015-1641 exploit documents. This will also work on other rtf exploit docs using a similar begin/end marker and xor cipher.')
parser.add_argument('inputfile', nargs="+", help="exploit document to examine")
parser.add_argument('-o' , '--outfile', help="output filename for extracted payload")
parser.add_argument('-d', '--decoy', help="output filename for extracted decoy document")
parser.add_argument('-l', '--length', type=int,help="length of each marker to search for (def: 7)", default=7)

parser.add_argument('-v', action="store_true",help='print debug messages')


args = parser.parse_args()

for afile in args.inputfile:
	print 
	print "# Processing {0}".format(afile)
	if os.path.isfile(afile):
		f = open(afile, "rb")
	else:
		print "	could not open file, skipping.."
		continue

	# Check for magic byte variants
	magic = f.read(4)

	if magic == "{\\rt":
		badheadchr=f.read(1)
		if args.v:
			if badheadchr != 'f':
				print "# Incomplete rtf header found, continuing.."
			else:
				print "# Found rtf header.."

	else:
		print '# No header found. Skipping..'
		#sys.exit()
		continue


	#Look for 0xBA 0xBA 0xBA 0xBA 0xBA 0xBA 0xBA
	if args.v: 
		print "# Looking for embedded payload and decoy markers of length {0}".format(args.length)

	marker_start = '\xba'
	marker_end = '\xbb'
	decoy_end = '\xbc'
	marker_length= args.length

	start_pos = find_marker(f,marker_start,marker_length)
	if start_pos:
		if args.v:
			print "# Found start marker at offset: 0x{:02X}".format(start_pos)
	else:
		print "# Failed to find start marker, skipping file.."
		#sys.exit()
		continue


	#Look for 0xBB 0xBB 0xBB 0xBB 0xBB 0xBB 0xBB
	end_pos = find_marker(f,marker_end,marker_length)
	if end_pos:
		if args.v:
			print "# Found end marker at offset: 0x{:02X}".format(end_pos-(marker_length))
	else:
		print "# Failed to find end marker, skipping file.."
		#sys.exit()
		continue

	decoy_pos = find_marker(f,decoy_end,marker_length)
	decoy_found=1
	if decoy_pos:
		if args.v:
			print "# Found decoy document end marker at offset: 0x{:02X}".format(decoy_pos-(marker_length))
	else:
		print "# Failed to find decoy marker"
		decoy_found = 0

	# open output files
	if args.outfile:
		outfile = open(args.outfile,"wb")
	else:
		outfile = open(afile + "_payload", "wb")

	if decoy_found:
		if args.decoy:
			decoyfile = open(args.decoy,"wb")
		else:
			decoyfile = open(afile + "_decoy","wb")
	#




	#grab payload content
	f.seek(start_pos)
	total_bytes= (end_pos-(marker_length))-start_pos
	if args.v:
		print "# Grabbing 0x{:02X} bytes for payload decryption...".format(total_bytes)
	cooked_payload = bytearray(f.read(total_bytes))


	#decrypt payload

	xor_key = bytearray([0xbe,0xba,0xfe,0xca])
	if args.v:
		print "	.. decrypting payload"

	decrypted  = xorb(cooked_payload, xor_key)

	outfile.write(decrypted)

	#Grab and decrypt decoy 
	if decoy_found:	
		f.seek(end_pos)
		decoy_bytes = (decoy_pos-(marker_length))-end_pos
		if args.v:
			print "# Grabbing 0x{:02X} bytes for decoy decryption..".format(decoy_bytes)
		decoy_payload = bytearray(f.read(decoy_bytes))

		decoy_xor_key = bytearray([0x0d,0xf0,0xad,0xba])
		if args.v:
			print "	.. decrypting decoy"
		
		decrypted_decoy = xorb(decoy_payload,decoy_xor_key)

		decoyfile.write(decrypted_decoy)

		decoyfile.close()


	f.close()

	outfile.close()
	if args.v:
		print "# Processing complete."
		print


sys.exit()