oletools icon indicating copy to clipboard operation
oletools copied to clipboard

Published 20 hours ago • verified publisher icon decalage2

rtfobj.py cannot handle uppercase Comment cword obfuscation inside objdata

Open arpitest opened this issue 2 years ago • 0 comments

found rtf file with such objdata obfuscation method: {*\objdata 0105000002000000 09000{*\Comment: NYnvC2fji...eSs9iMZ}0004f{*\Comment: W9PwfYW96HEpr etc.

i had to change this: if cword in DESTINATION_CONTROL_WORDS: to: if cword.lower() in DESTINATION_CONTROL_WORDS:

i'm not sure if this is the proper fix, maybe accepting any cword is better?

arpitest avatar Apr 17 '22 20:04 arpitest