May 23, 2021 in Archaeology, Living off the land, LOLBins
This one was on a back burner for a while too.
C:\Program Files*\Microsoft Office\root\Office*\excelcnv.exe is a program that helps to convert various documents to XLSX format. While playing around with it I noticed it accepts URLs hence you can use it to download stuff from the internet. The caveat is that this downloaded data will be stored inside a UTF8-encoded stream embedded inside the XLSX Zip archive.
Example binary data (favicon.ico):
and data downloaded as a stream:
The command line arguments for excelcnv.exe are not documented well. Many examples online refer to “-oice” argument followed by the input and output file names. That’s it. And yeah, this actually works, so since I have already mentioned that input parameter can be an URL, the downloader invocation can be as follows:
excelcnv.exe -oice <URL> <OUPUT>
Still, there is more to discover.
For instance, what the heck is ‘oice’? After googling around I eventually discovered it stands for Office Isolated Conversion Environment.
Other interesting stuff to look at are other, undocumented command line arguments used by excelcnv.exe – these I found so far are as follows:
There are probably more, but this is what I explored so far.
The default OUTPUT file type is XLSX. The file format can be changed using a dedicated file extension accepted by the program:
but not sure yet how to use all of them as not all of them worked for me (good news is that all the *.xl* work well with “-oice” command).