Having Fun with ActiveX Controls in Microsoft Word

**Executive summary:** This write-up demonstrates two practical techniques for UNC path injection in Microsoft Word using built-in ActiveX controls (Windows Media Player and ShockWave Flash) to trigger outbound SMB/WebDAV requests and capture Net-NTLM hashes, outlines observations about fallback behaviors and macro execution via ActiveX, reports disclosure to Microsoft, and recommends mitigations such as blocking outbound SMB (port 445) and disabling ActiveX via Group Policy.