Outlook and Exchange for the Bad Guys - Nick Landers

Explore the intricacies of Outlook and Exchange security in this 44-minute conference talk from Derbycon 2016. Delve into topics such as Exchange Server reconnaissance, credential collection techniques, and the inner workings of Outlook rules. Learn about rule actions, shellcode execution, and potential exploitation challenges. Examine real-world use cases and a detailed case study to understand the current state of Outlook and Exchange security. Gain valuable insights into potential vulnerabilities and defensive strategies through practical demonstrations and expert analysis.

Intro
Tonight's Agenda
ES Exchange
Recon
Collecting Credentials pt. 2
Outlook Rules Overview
Rule Actions
Peeking Inside
A Deeper Look
ShellExecute Ex
Exploitation Challenges
Use Cases
State of things
Demo!
Case Study #1
What Now?
Questions?