Recently, I had to extract embedded files from a set of OneNote files (extension .one).
My onedump.py tool can extract individual files, so I would have to run this many times. To avoid this, I added a new feature to my onedump.py tool: producing JSON data. Several of my tools already have such a feature: they produce JSON data with the content of their analysis results.
onedump's option –jsonoutput produces JSON output with the content of each embedded file found inside the OneNote file. And it can do this for many .one files in one go:
onedump.py –jsonoutput *.one
To write these files to disk you can use my myjson-filter.py tool, like this:
onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir
This will write all the embedded files to disk, their name will be the sha256 hash of their content plus extension .vir (hashvir).
Didier Stevens
Senior handler
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.