Everything Stays Local
Document malware, and sanitising it without uploading anything.
Slides
Both present in the browser — arrow keys, space or click to advance,
f for full screen. Same 36 slides, two house styles.
Present → with demonstrations
64 slides · the Accenture deck with 28 worked
demonstrations interleaved — the artifacts and the disarm shown
against real files rather than described
Present → SOC analyst, Accenture style
31 slides · the artifacts to pivot on, why each technique
evades the control you already have, and where this fits next to a
sandbox you are not always allowed to use
Present → project style, technical
36 slides · the five families of document-borne execution,
why the usual defences fit badly, and how the sanitiser is built
Present → Accenture house style
the same 36 technical slides, set in Accenture’s house style
Or take the PDF: with demonstrations ·
SOC analyst ·
project style ·
Accenture
Paper
Read → companion paper
9 pages · the same material argued rather than asserted —
the full PDF action table, where the tool deliberately disagrees with the
sanitiser it was ported from, and the implementation mistakes with enough
context to be useful
Tools used in the demonstrations
Linked rather than bundled. These are other people’s tools, and you
want the current version from the author, not a copy frozen inside a talk.
pdfid.py
— Didier Stevens. Counts the PDF names that mean “do” rather than
“draw”, and the origin of the length-preserving disarm this tool
implements.
(source)oledump.py
— Didier Stevens. Walks OLE2 streams and dumps them.
(source)olevba / oletools
— Philippe Lagadec. Extracts and deobfuscates VBA.
pip install oletoolsmutool — MuPDF
— Artifex. Used as an independent second opinion on a rewritten PDF:
checking output with the parser that produced it proves only that it
agrees with itself.- LibreOffice
— for the “convert it and re-scan the copy” advice given for
legacy formats this tool deliberately does not rewrite.
unzip, xxd, file, strings,
grep, sha256sum — your distribution’s.
On Debian or Ubuntu:
apt install unzip xxd file binutils mupdf-tools
What the talk covers
- Why a document is a container format with an execution surface, not a picture of information
- Macro code, embedded objects, remote fetch, reader features, legacy containers — and the artifact each one leaves
- Remote template injection: a file that is malicious while containing nothing malicious
- Why uploading a suspicious document to ask whether it is dangerous publishes it
- The length-preserving PDF disarm, and why byte-identical output is the canary for rewriter correctness
- Capability naming: saying what a document tries to do — auto-execute, launch, download, persist — without shipping a signature corpus
- Reading the macro rather than the crumbs: MS-OVBA decompression, and why
strings on a maldoc never shows a whole procedure
- Content dispatch: why routing on the file extension fails open on the oldest trick there is
- Verify-after-scrub — the plan says what it meant to remove; only a re-scan says what the output contains
- What the tool does not do
The tool
Toilet Duck Web is a single index.html. It opens from disk, has no
dependencies, and makes no network requests — the files you scan never
leave the machine.
toiletduck.cleaning