Office in Wonderland
summary
Shows specific exploits: include picture fields in .dot/.dotx templates force a basic‑auth credential prompt (CVE 0540) to harvest passwords; layered fields plus include text pull local files (unattend) and exfiltrate them; Get & Transform (M) imports local/AD/Azure data into Excel then posts it out line‑by‑line; Excel 4.0 macros execute shellcode, hide in very hidden sheets and via P‑code (Evil Clippy) evade scanners; COM/DCOM runs macros remotely for diskless lateral movement and practical AMSI/ASR bypasses.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:11Demo
- 2:35Fields
- 6:35Credential stealing
- 15:37Do we need VBA
- 16:00Macros
- 18:30Shell Code
- 19:06Active File Format
- 21:21Silk
- 24:49Compound Files
- 26:54Module Stream
- 28:18Evil Clippy
- 36:49MZ
- 40:16Bypass MZ
- 45:45Conclusion
related talks
48m"Sneaking Past Device Guard"
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
20mOffice Document Security and Privacy
43mHunting for Bugs, Catching Dragons
25mCommSec D1 - A Deep Dive Into Malicious Documents
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
51mSneaking Past Device Guard
44mWhen you can't afford 0days: Client-side exploitation for the masses