NetworkMashup.xls is a spreadsheet with VBA macros I scraped from the Internet to execute pings and name/address resolution from within Excel with WIN32 API calls.

Not only is it handy when you need to do some network mapping in a restricted environment, but also if you’ve just a list of machines to monitor.

The spreadsheet contains several sheets. One sheet to perform a single ping:

One sheet to ping/resolve a list:

One sheet to list the IP addresses of the current machine:

And last, a sheet with settings:

Download here.

View full post on Didier Stevens

• Quickpost: “It Does No Harm…” or Does It?
  You often read about people who use many different security applications to protect their systems. Not only anti-virus, anti-spyware, firewall, HIPS, …, but also some other tools like anti-keyl...
• Quickpost: Checking ASLR
  Some people asked me for a simple way to check shell extensions for their ASLR support. You can do this with Process Explorer. Start Process Explorer, and set the lower pane to display DLLs. Select p...
• Quickpost: Adobe Reader X
  In case you’ve not read Adobe’s announcement: Adobe Reader X is out. Use Adobe’s FTP server if you want to avoid their download manager. Protected Mode Adobe Reader comes with a sand...
• Quickpost: Adding Certificates to the Certificate Store
  A couple of people asked me how to get self-signed certificates recognized by Windows. For example, when you check the digital signature of one of my programs (like ariad.exe), you’ll see this: ...
• Quickpost: Ariad & DLL Preloading
  I’m writing this quickpost just in case you hadn’t figured this out for yourself: the techniques I described to protect machines from the .LNK vulnerability also help you mitigate the DLL ...
• Quickpost: .LNK Template Update
  I updated my .LNK template with info I got from comments from WndSks and Forrest Gump. This new version identifies well-known Shell GUIDs: Quickpost info View full post on Didier Steven...
• Quickpost: 2 .LNK Tools
  Microsoft has issued an emergency patch (MS10-046) for the .LNK file vulnerability (CVE-2010-2568). I’m releasing two small tools I developed to help me investigate this vulnerability. First one...
• Quickpost: Preventing the /Launch Action “cmd.exe” Bypass
  Adobe has released a new Adobe Reader version that contains functionality to block my /Launch action PoC, but Bkis found a bypass: just put double quotes around cmd.exe, like this:  “cmd.exeR...
• Quickpost: No Escape From PDF
  Adobe has released a new Adobe Reader version with a fix for my /Launch action PoC PDF. Before version 9.3.3: Since version 9.3.3: Not only is the dialog box fixed, but the /Launch action is also di...
• Quickpost: More Malformed PDFs
  Here’s a heads up for some malicious PDF samples that are deliberately malformed to avoid detection. The most important case is the missing endobj keyword: Adobe Reader will happily parse a PDF...