Hunting for Bugs, Catching Dragons
summary
Microsoft research demonstrates concrete Outlook and Exchange attack chains, with working demos, PoCs and patches. Examples include a preview pane exploit that invokes COM monikers to load Flash and run VBScript (tested on colleagues, timed seconds), TNEF/RTF template keywords that force SMB/NTLM fetches, and abuse of safe arrays/unmarshal to coerce object loading. Tools used include MFCMapi and storage inspection (OpenStorage/OLFile streams). An XRPC parsing bug allows crashes by sending ~24 crafted mails; some issues are fixed.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 2:25Email Exploits
- 5:08Attack Surface
- 7:12Why Im doing this
- 8:31TAF
- 12:46RTF Issues
- 16:08Video Interrupt
- 21:21Audio Objects
- 24:23Invoke monikers
- 26:07Windows chat links
- 27:58Video controller
- 30:01Bug fixes
- 31:27Common marshalling
- 34:18Exchange
- 37:54XR PCM
- 40:22PostReply
- 42:17Conclusion
related talks
45mThe Code Behind The Vulnerability
51mOffice in Wonderland
01h 09mKeynote: An Unauthorized Exchange - From Targeted Espionage to the Global Cyber Pandemic
56mD1T2 - Attacking Microsoft’s .NET Framework Through CLR
58mThe Code Behind The Vulnerability
25mCommSec D1 - A Deep Dive Into Malicious Documents
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
44mWhen you can't afford 0days: Client-side exploitation for the masses