Zi+BpSrSrSSKrSSKrSSKrSSKJrJr SSKJ r SSK r SSK J r SSK r \RR!\RR#\RR%\555r\RR!\RR+\S55r\\R;a\RR/S\5 SSKJrJrJrJrJr SS KJr S r \RB"S 5r"S r#S r$Sr%Sr&Sr'Sr(\'\(SSSSS/r)Sr*Sr+SSjr,g!\a Sr GNf=f)a crypto.py Module to be used by other scripts and modules in oletools, that provides information on encryption in OLE files. Uses :py:mod:`msoffcrypto-tool` to decrypt if it is available. Otherwise decryption will fail with an ImportError. Encryption/Write-Protection can be realized in many different ways. They range from setting a single flag in an otherwise unprotected file to embedding a regular file (e.g. xlsx) in an EncryptedStream inside an OLE file. That means that (1) that lots of bad things are accesible even if no encryption password is known, and (2) even basic attributes like the file type can change by decryption. Therefore I suggest the following general routine to deal with potentially encrypted files:: def script_main_function(input_file, passwords, crypto_nesting=0, args): '''Wrapper around main function to deal with encrypted files.''' initial_stuff(input_file, args) result = None try: result = do_your_thing_assuming_no_encryption(input_file) if not crypto.is_encrypted(input_file): return result except Exception: if not crypto.is_encrypted(input_file): raise # we reach this point only if file is encrypted # check if this is an encrypted file in an encrypted file in an ... if crypto_nesting >= crypto.MAX_NESTING_DEPTH: raise crypto.MaxCryptoNestingReached(crypto_nesting, filename) decrypted_file = None try: decrypted_file = crypto.decrypt(input_file, passwords) if decrypted_file is None: raise crypto.WrongEncryptionPassword(input_file) # might still be encrypted, so call this again recursively result = script_main_function(decrypted_file, passwords, crypto_nesting+1, args) except Exception: raise finally: # clean up try: # (maybe file was not yet created) os.unlink(decrypted_file) except Exception: pass (Realized e.g. in :py:mod:`oletools.msodde`). That means that caller code needs another wrapper around its main function. I did try it another way first (a transparent on-demand unencrypt) but for the above reasons I believe this is the better way. Also, non-top-level-code can just assume that it works on unencrypted data and fail with an exception if encrypted data makes its work impossible. No need to check `if is_encrypted()` at the start of functions. .. seealso:: [MS-OFFCRYPTO] .. seealso:: https://github.com/nolze/msoffcrypto-tool crypto is part of the python-oletools package: http://www.decalage.info/python/oletools z0.60N)splitextisfile)mkstemp) OleFileIOz..)CryptoErrorBaseWrongEncryptionPasswordUnsupportedEncryptionErrorMaxCryptoNestingReachedCryptoLibNotImported) log_helper cryptocJ[R[R5 g)z Enable logging for this module (disabled by default). For use by third-party libraries that import `crypto` as module. This will set the module-specific logger level to NOTSET, which means the main application controls the actual logging level. N)logsetLevelr NOTSETi/var/www/eduai.edurigo.com/question_generate/ques_gen_env/lib/python3.13/site-packages/oletools/crypto.pyenable_loggingrsLL""#rcn[5(a[RS5 SnSn[U[5(a.UR nUR 5nURS5 O [US5n[R"U5R5UbURU5 $UR5 $[U[5(a [#U5$[$R&"U5(a [)U5$[ U5n[#U5sSSS5 $![a.n[RSRU55 SnA$SnAff=f![a.n[R!SRU55 SnAOSnAff=fUbURU5 NUR5 GN![a/n[RSRU55 SnAGN:SnAff=f!UbURU5 fUR5 f![a.n[RSRU55 SnAfSnAff=f=f!,(df  g=f![a.n[R!SRX55 SnAgSnAff=f) a Determine whether document contains encrypted content. This should return False for documents that are just write-protected or signed or finalized. It should return True if ANY content of the file is encrypted and can therefore not be analyzed by other oletools modules without given a password. Exception: there are way to write-protect an office document by embedding it as encrypted stream with hard-coded standard password into an otherwise empty OLE file. From an office user point of view, this is no encryption, but regarding file structure this is encryption, so we return `True` for these. This should not raise exceptions needlessly. This implementation is rather simple: it returns True if the file contains streams with typical encryption names (c.f. [MS-OFFCRYPTO]). It does not test whether these streams actually contain data or whether the ole file structure contains the necessary references to these. It also checks the "well-known property" PIDSI_DOC_SECURITY if the SummaryInformation stream is accessible (c.f. [MS-OLEPS] 2.25.1) :param some_file: File name or an opened OleFileIO :type some_file: :py:class:`olefile.OleFileIO` or `str` :returns: True if (and only if) the file contains encrypted content z)Checking for encryption using msoffcryptoNrrbz"Ignoring error during clean up: {}zImsoffcrypto failed to parse file or determine whether it is encrypted: {}zCFailed to check {} for encryption ({}); assume it is not encrypted.F)check_msoffcryptordebug isinstancerfptellseekopen msoffcrypto OfficeFile is_encryptedclose Exceptionwarningformatinfo_is_encrypted_olezipfile is_zipfile_is_encrypted_zip) some_file file_handlefile_posexcoles rr"r"sF: =>  N)Y//'ll &++-  #"9d3 ))+6CCE N'$$X.%%' 9 i + +$Y/ /   i ( ($Y/ / y !S$S)" ! N @GGLMM N & HH6 & & & & N'$$X.%%' N @GGLMM N  N'$$X.%%' N @GGLMM N" !  9 !!' !7 9 9  9sA2E%D*2D*I<$%I< I< I+ I<* E"4$EE"% F/$FHFH"G 7G H$G==HI(H-I(H-,I(- I%7$I I( I%%I(+ I95I<9I<< J4$J//J4c[RS5 [R"US5nUR 5SnUR US5nUR [SUR55 SSS5 SSS5 g!,(df  N=f![a!nS[U5;sSnAsSSS5 $SnAff=f!,(df  g=f)z>Specialization of :py:func:`is_encrypted` for zip-based files.z#Checking for encryption in zip filerrNFcrypt) rrr)ZipFileinfolistrreadmin file_size RuntimeErrorstr)filenamezipper first_entryreaderrt_errs rr+r+sII34 3 '6oo'*  *[#.& CK$9$9:;/ ( '/. *c&k) ) ( '  * ( 'sMC B&B :B B B C' C4C5C CC  Cc[RS5 URS5(a%URS5nSU;aUSS-(agURS5(a[RS5 gURS5(aURS 5(dgURS 5(aS nUR S /5nUR S 5 [ R"S UR S55SnUS-S- nU(aUbUR5 ggUbUR5 gg!UbUR5 ff=f)z8Specialization of :py:func:`is_encrypted` for ole files.z#Checking for encryption in OLE filezSummaryInformationTEncryptionInfozfound stream EncryptionInfoEncryptedSummarySummaryInformation WordDocumentNr HrF) rrexists getproperties openstreamr7structunpackr#)r0 suminfo_datastreamtemp16 f_encrypteds rr(r(s=II34  zz*++(()AB < \$%7!%;  zz"## /0 zz$%% /00 zz.!! ^^^$45F KKO]]3 A7:F!F?q0K! "!   ! "s AE E VelvetSweatshopz/01Hannes Ruescher/011231234123451234564321c&[c [5eg)zERaise a :py:class:`CryptoLibNotImported` if msoffcrypto not imported.N)r r rrr_check_msoffcryptor\2s"$$rc[SL$)z:Return `True` iff :py:mod:`msoffcrypto` could be imported.N)r rrrrr8s d ""rc [5 [U[5(aU4nO U(d[nSU;aSUS'SU;a[ U5SUS'SUS'Sn[ US5n[ R"U5nWR!5(d[#SR%U55eUHn[RSR%U55 SnSn SnUR'US9 [)S0UD6up[*R,"US5n SnUR/U 5 U R15 Sn O SSS5 [RS5 U$![acnS [U5;aN[RS S S 9 [RRS :Xa [U5e[S5 SnAGNAeSnAff=f![a} [RSS S 9 U (aU R15 OU(a[*R0"U5 U(a&[3U5(a[*R4"U5 SnGMf=f!,(df  GN =f)a Try to decrypt an encrypted file This function tries to decrypt the given file using a given set of passwords. If no password is given, tries the standard password for write protection. Creates a file with decrypted data whose file name is returned. If the decryption fails, None is returned. :param str filename: path to an ole file on disc :param passwords: list/set/tuple/... of passwords or a single password or None :type passwords: iterable or str or None :param temp_file_args: arguments for :py:func:`tempfile.mkstemp` e.g., `dirname` or `prefix`. `suffix` will default to suffix of input `filename`, `prefix` defaults to `oletools-decrypt-`; `text` will be ignored :returns: name of the decrypted temporary file (type str) or `None` :raises: :py:class:`ImportError` if :py:mod:`msoffcrypto-tools` not found :raises: :py:class:`ValueError` if the given file is not encrypted prefixzoletools-decrypt-suffixrCFtextNrzUnrecognized file formatzCaught exceptionT)exc_inforIz4raise UnsupportedEncryptionError(filename) from Nonez%Given input file {} is not encrypted!z$Trying to decrypt with password {!r})passwordwbzFailed to decryptzAll passwords failedr)r\rr;DEFAULT_PASSWORDSrrr r!r$rrsys version_infomajorr execr" ValueErrorr&load_keyrosfdopendecryptr#runlink) r< passwordstemp_file_args decrypt_filer? crypto_filer/rcwrite_descriptor write_handles rrnrn=s3*)S!!M % ~%#6x ~%#+H#5a#8x "N6L h  %008K''))D$fX.0 0"H II<CCHM N# LL $$$h$7291J>1J. !yy)94@ #' ##L1""$# #"' bII$% _ )SX5 ,t <##))Q.4X>>OPP D $ - =  &&(%HH-.F<$8$8IIl+#  $K  sd&I(E>AIAG5I G"AG9I?GGIBI III I!)N)-__doc__ __version__rfrOrlos.pathrrtempfilerr)olefilerr ImportErrorpathnormpathabspathdirname__file___thismodule_dirjoin _parent_dirinsertoletools.common.errorsrrr r r oletools.common.log_helperr MAX_NESTING_DEPTHget_or_create_silent_loggerrrr"r+r(EXCEL_TRANSPARENT_PASSWORDPOWERPOINT_TRANSPARENT_PASSWORDrer\rrnrrrrs2=D $''""277??277??83L#MNggrww||OTBC chhHHOOA{#NN1  ,,X6 $K\ *)`/ #:01PFGXv?% # WYKsD))D54D5