Post #3917270
2026-07-18 15:39 UTC
@wdormann@infosec.exchange the "old" way was to try and find a COM object that crashed in a useful way just by being loaded. I've no idea how common that is anymore, let alone if they'd be exploitable on a modern system with current mitigations. Is pretty easy to check, just load every class on the system and see if anything crashes.
Does the method you're using to get the class loaded do anything with it like access its IPersist interface? That at least expands the attack surface.
Replies (1)
-
@wdormann@infosec.exchange 2026-07-18 18:25
@tiraniddo@infosec.exchange Yeah, I recall doing such things in the past with seeing how objects behave when loaded in a RTF file in word. And some were quite interesting. (Some crashes, some attempts to load a DLL or a .py file from the same directory as the RTF document.) This case is a service, so I don't think anything CWD-related will be interesting. And I can simply choose which object to load in the service based on its CLSID. With Word, I could just brute force it all with BFF directly. But this being service based makes things a bit separated from the fuzzing framework, so I suppose a bit more tooling would be involved if I want to brute force test things.