Anti-Malware-Alliance / docubleach

Tool to Purge and Remove all Macro And Dynamic Content from MS Office File
MIT License
2 stars 0 forks source link

DocuBleach - Add .ppt file support #25

Open Patterbear opened 2 months ago

Patterbear commented 2 months ago

The DocuBleach tool already supports all BFF office formats EXCEPT .ppt.

Support has not yet been added as .ppt files embed their macros within the 'Presentation' stream of the file.

This is problematic, as the current method of removing macros for BFF files is by finding the VBA stream and replacing its contents with empty bytes. Attempting this on a .ppt corrrupts it.

olefile only allows us to access these streams, and not whats within them. A way must be found to delve into the stream and wipe VBA content.

To add this functionality, you must first add 'ppt' to the global 'bff_formats' array in the start of bleach.py.

Then, you can add your logic to the 'if file_type == "ppt"' if statement, located at the bottom of the 'remove_bff_macros' function.

I have left a single line of code that returns a list of all the streams found within the file. The resulting variable can then be printed.