OOXML Spreadsheets Protected By Verifier Hashes, (Sat, Aug 3rd)
2024-8-4 15:23:41 Author: isc.sans.edu(查看原文) 阅读量:6 收藏

When I wrote about the internal file format of protected spreadsheets, I mentioned a simple 16-bit hash for .xls files in diary entry "16-bit Hash Collisions in .xls Spreadsheets" and a complex hash based on SHA256 for .xlsx files in diary entry "Protected OOXML Spreadsheets".

But what happens if you open a protected spreadsheet in OLE format (.xls) and save it in OOXML format (.xlsx)?

In that exceptional case, the XML protection elements in the OOXML file will store the 16-bit hash taken from the OLE file:

Didier Stevens
Senior handler
blog.DidierStevens.com


文章来源: https://isc.sans.edu/diary/rss/31072
如有侵权请联系:admin#unsafe.sh