Collaborative RCE Tool Library - Data Extraction Tools

Tool Added: Pdf-parser

Thu, 05 Nov 2009 01:26:57 GMT

Listed in categories: Data Extraction Tools

Most recent version:
0.3.1

Most recent release date:
May 13, 2009

Description:
This tool will parse a PDF document to identify the fundamental elements used in the analyzed file. It will not render a PDF document. The code of the parser is quick-and-dirty, I’m not recommending this as text book case for PDF parsers, but it gets the job done.

The stats option display statistics of the objects found in the PDF document. Use this to identify PDF documents with unusual/unexpected objects, or to classify PDF documents. For example, I generated statistics for 2 malicious PDF files, and although they were very different in content and size, the statistics were identical, proving that they used the same attack vector and shared the same origin.

The search option searches for a string in indirect objects (not inside the stream of indirect objects). The search is not case-sensitive, and is susceptible to the obfuscation techniques I documented (as I’ve yet to encounter these obfuscation techniques in the wild, I decided no to resort to canonicalization).

filter option applies the filter(s) to the stream. For the moment, only FlateDecode is supported (e.g. zlib decompression).

The raw option makes pdf-parser output raw data (e.g. not the printable Python representation).

objects outputs the data of the indirect object which ID was specified. This ID is not version dependent. If more than one object have the same ID (disregarding the version), all these objects will be outputted.

reference allows you to select all objects referencing the specified indirect object. This ID is not version dependent.

type alows you to select all objects of a given type. The type is a Name and as such is case-sensitive and must start with a slash-character (/).

Tool Updated: Universal Extractor

Mon, 16 Mar 2009 17:36:34 GMT

Listed in categories: Data Extraction Tools

Most recent version:
1.6

Most recent release date:
October 17, 2008

Description:
Universal Extractor is a program do to exactly what it says: extract files from any type of archive, whether it's a simple zip file, an installation program, or even a Windows Installer (.msi) package. This is still a work in progress (see details below), but so far it's proven quite useful and I feel others can also benefit from it.

I should stress that this application is not intended to be a general purpose archiving program. It will never replace WinRAR, 7-Zip, etc. What it will do is allow you to extract files from virtually any type of archive, regardless of source, compression method, etc. The original motivation behind this project was that I wanted an easy, convenient way to extract files from installation packages, such as Inno Setup or Windows Installer packages, without pulling up a command line every time. In the process I got a little carried away and ended up throwing in support for every kind of archive format I possibly could find.

Tool Added: PDF Streams Inflater

Mon, 29 Sep 2008 18:00:09 GMT

Listed in categories: Data Extraction Tools

Most recent version:

Most recent release date:
September 24, 2008

Description:
I've made this tool because PDF exploits (JavaScript inside PDF) are mostly hidden inside compressed streams.
It will find and decompress zlib compressed streams. A new file per stream found will be created, where every such file will contain the decompressed stream content.

Hope you will find it useful.

I've made it in 3 hours (inclusive doing a research about streams in PDF files), so it may have some glitches and bugs. Please report your findings and/or suggestions.

I have tested it on PDF files created by a couple of tools as there are some differences in created files between tools (different EOL, EOL after token identifier etc.)