COMThanasia: analyzing common vulnerabilities in COM

1. Create an instance and call the methods of that COM object to, for example, write an arbitrary file on behalf of the system. For example, you have found a COM object with a DeployCmdShell() method that runs on behalf of the NT AUTHORITY\SYSTEM account and you have LaunchPermissions and AccessPermissions. You can start this COM object, call the DeployCmdShell() method, and get code execution on behalf of the system. You can view the available methods using ClsidExplorer.
2. Abuse DCOM authentication. For this, see RemoteKrbRelay

ComDiver

All information about COM objects is in the registry. But what if the registration was incorrect? In such a case we have a possibility to override COM settings, for example, to hijack the executable file. This tool allows you to detect such vulnerabilities, and it scans the registry according to the priority of keys that are viewed when searching for COM objects. In this way, you can even find Shadow COM Hijacking.

If you see red in lines in the tool output, this is a potential way to abuse a COM object! You can perform COM Hijacking (spoofing an existing executable), or Shadow COM Hijacking (spoofing a missing executable). Read more about COM Hijacking here

MonikerHound

There is a built-in way to bypass UAC on a Windows system, this is done through Elevation Moniker. You can read more about it here. This kind of UAC Bypass requires a non-standard way of registering the COM object in the registry, which is fairly easy to trace. So you can use my tool to find new ways of UAC Bypass.

Once you have discovered potential candidates for UAC Bypass, you can start checking them out. As a great template for running Elevation Moniker, you can take this function, or this program.

ClsidExplorer

ClsidExplorer allows you to retrieve information about a specific CLSID. The program outputs the following data:

• AppID – ApplicationID of a specific COM Object;
• ProgID – ProgID of a specific COM Object;
• PID – PID in which this COM Object is running;
• Process Name – the name of the PID process;
• Username – name of the user on whose behalf the process is running;
• Methods – available methods of the COM Object. Made by parsing TypeLib.

This program is great for checking a COM class discovered with ComTraveller or PermissionHunter or MonikerHound for interesting methods that can be abused.

ComTraveller

ComTraveller – this tool allows you to explore all available COM objects. First, it allows you to quickly identify COM objects with interesting values (RunAs Interactive User), availability of TypeLib, and Cross-Session Activation capabilities. Thus, you can quickly detect objects that may be instantiated in another user session, leading to privilege escalation.

Download