diff --git a/PDFConsole.py b/PDFConsole.py index 5b9b3d9..e0b1de2 100644 --- a/PDFConsole.py +++ b/PDFConsole.py @@ -4196,7 +4196,7 @@ def checkInputContent(self, objectType, objectContent): except: return None elif objectType == 'string': - octalNumbers = re.findall('\\\\(\d{1,3})', objectContent, re.DOTALL) + octalNumbers = re.findall('\\\\([0-7]{1,3})', objectContent, re.DOTALL) for octal in octalNumbers: try: chr(int(octal, 8)) diff --git a/PDFCore.py b/PDFCore.py index 3b2fe00..55f7428 100644 --- a/PDFCore.py +++ b/PDFCore.py @@ -609,6 +609,12 @@ def update(self, decrypt = False): self.value = self.value.replace('\\\r','') self.value = self.value.replace('\\\n','') ''' + smbAddr = [] + pos = 1 + for match in re.findall(r'\\\\((?:(?:25[0-5]\.)|(?:2[0-4][0-9]\.)|(?:[01]?[0-9]?[0-9]\.)|(?:[0-9]\.)){3}(?:(?:25[0-5])|(?:2[0-4][0-9])|(?:[01]?[0-9][0-9]?)|(?:[0-9])))', self.value): + smbAddr.append({'content': match, 'position': pos}) + self.value = self.value.replace(match, '{{' + str(pos) + '}}') + pos += 1 octalNumbers = re.findall('\\\\([0-7]{1,3})', self.value, re.DOTALL) try: for octal in octalNumbers: @@ -618,6 +624,8 @@ def update(self, decrypt = False): errorMessage = 'Error in octal conversion' self.addError(errorMessage) return (-1,errorMessage) + for match in smbAddr: + self.value = self.value.replace('{{' + str(match['position']) + '}}', match['content']) if isJavascript(self.value) or self.referencedJSObject: self.containsJScode = True self.JSCode, self.unescapedBytes, self.urlsFound, jsErrors, jsContexts['global'] = analyseJS(self.value, jsContexts['global'], isManualAnalysis)