Post #3896732
2026-07-17 22:18 UTC
If I theoretically have a way for a non-admin Windows user to be able to load an arbitrary already-on-system COM object library (InprocServer32) into a process that has system integrity, that could be argued to be a security boundary bypass.
But in the essence of PoC||GTFO, does anybody have any ideas for how this might be useful to an attacker? i.e., is there an object that can be leveraged to lead to privileged code execution?
Replies (2)
-
@SpaceLifeForm@infosec.exchange 2026-07-17 22:22
@wdormann@infosec.exchange This sounds like an Edge case.
-
@tiraniddo@infosec.exchange 2026-07-18 15:39
@wdormann@infosec.exchange the "old" way was to try and find a COM object that crashed in a useful way just by being loaded. I've no idea how common that is anymore, let alone if they'd be exploitable on a modern system with current mitigations. Is pretty easy to check, just load every class on the system and see if anything crashes. Does the method you're using to get the class loaded do anything with it like access its IPersist interface? That at least expands the attack surface.