Abusing RTF - Exploitation, Evasion, and Exfiltration

Explore advanced techniques for exploiting, evading detection, and exfiltrating data using RTF (Rich Text Format) in this 31-minute conference talk from Derbycon 2016. Dive into key points for both blue and red teams, examining RTF features, file extension tampering, magic files, and various evasion methods. Learn about real-world examples, bin substitution, control words, and fuzzing techniques using tools like Peach. Discover how to forge images, exploit vulnerabilities, and understand the exploit tree. Gain insights into countermeasures and potential failures, equipping yourself with valuable knowledge for both offensive and defensive cybersecurity strategies.

Introduction
Blue Team Key Points
Red Team Key Points
RTF Features
Why Care
File Extension Tampering
Magic Files
Mixed Case
Evasions
In the wild
What does this mean
Bin substitution
Control words
More examples
How to fuzz
Peach
Demo
Food for thought
Forge Images
Exploitation
Exploit Tree
countermeasures
other failures