@tiraniddo@infosec.exchange

James Forshaw

@tiraniddo@infosec.exchange · 6d ago

Replying to @R41N3RZUF477@infosec.exchange

@R41N3RZUF477@infosec.exchange it doesn't require any special privileges, so I don't think it's a duplicate :)

0

1

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 28, 2026

Seems that the trick I used in https://projectzero.google/2025/01/windows-bug-class-accessing-trapped-com.html by calling ITypeInfo::CreateInstance cross process has been blocked. Sort of. They've "fixed" it in a bizarre way, there's now a new AppCompat key, which doesn't exist by default. It's HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ITypeInfoCreateInstanceSettings and in that you need a AllowedOutOfProcIIDList REG_MULTI_SZ value which provides the allow list for the CreateInstance call which is checked in the stub function. However it's not allow listing CLSIDs, it's allow listing the IID you request. I guess the idea is you put a very specific IID in there which only a specific class can satisfy, as if someone puts in IID_IUnknown it all falls apart. TBH this only really fixes a risk of EoP. It doesn't block the PPL attack vector, at least from admin as they can just modify this key. And I think I have a way of getting it work even without admin ;)

projectzero.google

Windows Bug Class: Accessing Trapped COM Objects with IDispatch

Posted by James Forshaw, Google Project Zero Object orientated remoting technologies such as DC...

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 27, 2026

Currently implementing an airgapped network by adding two network cards to a macbook air and turning on IP forwarding.

0

2

1

James Forshaw

@tiraniddo@infosec.exchange · Jul 25, 2026

Replying to @zzt@mas.to

@zzt@mas.to the reason the French workers are so militant is due to the cheap and easy availability of good quality bread. The shitiness of US bread is a plot by the elite to keep the proles in their place.

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 24, 2026

Replying to @0x00string@infosec.exchange

@0x00string@infosec.exchange "Chris Anley, the chief scientist at security consulting giant NCC Group, said that asking an AI model to try to exploit a bug is a key step in confirming it’s a real vulnerability worth fixing." Jesus tap dancing Christ. How did we get here?

1

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 24, 2026

Replying to @wdormann@infosec.exchange

@wdormann@infosec.exchange @ferrix@mastodon.online I just put in all 1's for that :D

3

1

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 22, 2026

Found another hilariously trivial Windows PPL, hard to believe I didn't see this one earlier. Doesn't work in full PP due to the nature of it, but TBH PPL-WinTCB is really all you need :)

8

1

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 21, 2026

Replying to @jerry@infosec.exchange

@jerry@infosec.exchange the only reason I visited recently was because work was paying and I lived in the SF Bay Area so getting back and forth to LV was easy. Now I'm back in the UK, work can't pay me enough to subject myself to that trip. I don't think you're missing much though.

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 20, 2026

Replying to @cR0w@infosec.exchange

@cR0w@infosec.exchange that's because CA is the only state which mandates a hand gun must be dishwasher safe, but due to the gun roster you can only buy 3rd gen so they can't enforce it.

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 18, 2026

Replying to @wdormann@infosec.exchange

@wdormann@infosec.exchange the "old" way was to try and find a COM object that crashed in a useful way just by being loaded. I've no idea how common that is anymore, let alone if they'd be exploitable on a modern system with current mitigations. Is pretty easy to check, just load every class on the system and see if anything crashes. Does the method you're using to get the class loaded do anything with it like access its IPersist interface? That at least expands the attack surface.

5

1

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 16, 2026

Replying to @wdormann@infosec.exchange

@wdormann@infosec.exchange I believe the impersonation is done by the kernel. I abused that a long time ago to get arbitrary file creation e.g. https://project-zero.issues.chromium.org/issues/42452405 surprised (or not) that behavior is still there.

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 15, 2026

Replying to @wdormann@infosec.exchange

@wdormann@infosec.exchange in https://project-zero.issues.chromium.org/issues/42452400 I hijacked SYSTEM's classes key (which doesn't exist by default) to get arbitrary code exec :D

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 11, 2026

Replying to @gsuberland@chaos.social

@gsuberland@chaos.social why would you do that to yourself? Play rimworld that is.

0

James Forshaw

@tiraniddo@infosec.exchange · Jun 30, 2026

Replying to @evilpaul_atebit@icosahedron.website

@evilpaul_atebit@icosahedron.website @pcy@icosahedron.website the quote is clearly disingenuous, not just for their ability to modify the client itself (if it was open source and inspectable, like Signal for example they could make a better claim) but also just because something is encrypted doesn't mean it's inaccessible when you control the platform. I'm pretty sure that at least iMessage has the ability to hold multiple "escrow" keys that all messages are encrypted to, which is transparent to the user and so could be deployed surreptitiously. I'd be shocked if WhatsApp doesn't have something similar. Of course whether they're doing it, is another matter. The risk might be too great, but this is Meta who've not shown much scruples in the past.

0

James Forshaw

@tiraniddo@infosec.exchange · May 06, 2026

I don't know flash card, zero rugby balls? The things we teach children today, sheesh.

7

1

0

James Forshaw

@tiraniddo@infosec.exchange · May 01, 2026

Lolz https://www.synacktiv.com/sites/default/files/inline-images/scroll_of_truth.webp

https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part-1.html
https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part.html

8

1

7

0

James Forshaw

@tiraniddo@infosec.exchange · May 01, 2026

Replying to @ChrisJohnRiley@infosec.exchange

@ChrisJohnRiley@infosec.exchange I agree, as someone who has had a greencard they almost certainly know more about me than most. I think if they want this access the EU should just opt out entirely and revoke visa free access for Americans and see how long that lasts. I have no plans to visit the USA any time soon. Then again no idea what the UK would do, probably acquiesce with a shrug.

0

2

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 27, 2026

Replying to @mossmann@mastodon.social

@mossmann@mastodon.social at first I thought, no that's not right. But I realized that my pronunciation of Romeo is different between the car brand and the NATO alphabet (as in RoMeo for the car, and RomEo for the alphabet) which confused me massively. Also fun, is NATO have a quiz on their website, https://www.nato.int/en/about-us/nato-history/history-by-theme/symbols-of-nato/nato-phonetic-alphabet I got 25/26 right, try and guess which one I failed if you go through the quiz yourself :)

2

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 20, 2026

@GossiTheDog@cyberplace.social is Mythos going to be the new go to excuse, after no one believed that they were hit by an "Advanced Attacker"?

cyberplace.social

Kevin Beaumont (@GossiTheDog@cyberplace.social) - Cyberplace

2

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 20, 2026

Replying to @oct0xor@mastodon.social

@oct0xor that's what caused v1 to be detected. In v2 I tried my best to refactor it until it stopped detecting and have never used it for a PoC since. Still, something must have decided to use it, or Defender is just detecting the use of a native API which happens to be used by malware somewhere.

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 17, 2026

@lcamtuf@infosec.exchange $700 a week I assume? :)

infosec.exchange

lcamtuf :verified: :verified: :verified: (@lcamtuf@infosec.exchange) - Infosec Exchange

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 17, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange nice. Surprised at how low cost the book is especially printed in colour, much cheaper than my last book :) TBH while the UK postage is a lot it's still pretty cheap in the grand scheme of things and I do like to support No Starch.

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 08, 2026

Replying to @qdkp@cyberplace.social

@qdkp @wdormann not sure I agree with the blog posts conclusion that there's no bug. The complex exploit is just using various tricks to make it as reliable as it can but it comes down to defender copying an arbitrary file through a symlink as SYSTEM. As for the redirection mitigation, god knows why they don't turn it out. It wouldn't shock me if it's some concern that it'll break some enterprise consumer using junctions , or maybe malware could hide itself.

2

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 07, 2026

Fucks sake, Defender is now signaturing on builds of my v2 version of NtObjectManager, god knows why. I fucking hate MS and Defender especially.

9

3

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 07, 2026

Replying to @wdormann@infosec.exchange

@wdormann actually going back it looks to me like Defender makes a copy of the file into a location the user can read, so not passing back a handle. Also not saying MSRC are in the right in any way, but certainly a super complex PoC combined with not 100% reliability won't have helped. Ideally a simple description should be enough for them but that's now how MSRC operate now. Maybe they can get Project Glasswing to the work for them in the future :)

3

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 07, 2026

Replying to @wdormann@infosec.exchange

@wdormann oh I see, it passes back a handle. I assumed Defender did something to the file, then the unprivileged process opened the file. And yeah if it passes back a read-only handle then the code can parse out the SAM's contents as everything else needed to decrypt the hashes is accessible without any privileges (bizarre IMO). No doubt it'd be relatively easy to narrow this down to something simpler as a PoC, perhaps that didn't help their case with MSRC who as you point out have become somewhat lazy in their triage process.

3

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 07, 2026

Replying to @wdormann@infosec.exchange

@wdormann I'm not sure the unprivileged process should be able to read the SAM in the VSS though, I assume Defender must be modifying the ACL or something on the file, which is the bug. Not looked at it, and not sure I trust running something that complex to check :D

0

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 07, 2026

Replying to @wdormann@infosec.exchange

@wdormann that's some seriously complex code :) A file redirection attack in the Windows Defender update process I guess?

2

1

0

James Forshaw

@tiraniddo@infosec.exchange · Apr 07, 2026

I've put up the slides from my Zer0Con 2026 presentation on Administrator Protection. https://github.com/tyranid/infosec-presentations/blob/master/Zer0Con/2026/Protecting%20your%20Administrator.pdf

5

0

4

0

James Forshaw

@tiraniddo@infosec.exchange · Mar 30, 2026

Replying to @itm4n@infosec.exchange

@itm4n@infosec.exchange I assumed the handle would give you much but thought I’d ask. Certainly would seem you’d be able to do something with the environment. Perhaps override windir or commonprogramfiles and hijack a DLL load?

0

1

0

James Forshaw

@tiraniddo@infosec.exchange · Mar 30, 2026

Replying to @itm4n@infosec.exchange

@itm4n@infosec.exchange not looked at it yet. Does it return a process handle to the caller? Also I assume you pass any command line? Perhaps you could abuse something like the COM IRundown interface callback by dumping process memory of a service?

0

1

0

James Forshaw

@tiraniddo@infosec.exchange · Mar 25, 2026

Of course I’m deeply angry that apple chose to prostate themselves to the ineffectual ofcom who should be spending their time enforcing real laws like against GBNews. But I do wonder what happens now with devices if you log off from your unverified apple account. Does it revert to “normal” operation ? Or with 26.4 will it come up by default in kid mode? Can you use an iPhone anymore without ever signing in?

2

0

1

0

James Forshaw

@tiraniddo@infosec.exchange · Mar 12, 2026

The new Google office in London is looking nice. https://blog.google/company-news/inside-google/around-the-globe/google-europe/united-kingdom/platform-37-the-ai-exchange/

I especially like how it's super energy efficient and uses low carbon materials while touting the world destroying tech that is AI. A masterclass of green washing.

14

0

6

0

James Forshaw

@tiraniddo@infosec.exchange · Mar 06, 2026

Replying to @R41N3RZUF477@infosec.exchange

@R41N3RZUF477 yeah I wouldn't send them anything on admin protection right now until the reenable it properly. I am still skeptical that it will be securable long term, but we'll see :)

0

James Forshaw

@tiraniddo@infosec.exchange · Mar 05, 2026

Replying to @siguza@infosec.space

@siguza yeah, I am curious if this is just Apple taking advantage/malicious compliance or if this is the new normal and no laptop sold in Europe will have a PSU going forward. Perhaps I wouldn't mind if they at least didn't charge full price for the PSU if you bought it with the laptop.

0

James Forshaw

@tiraniddo@infosec.exchange · Mar 04, 2026

The new macbook neo looks somewhat cute, but, it doesn't come with a PSU? Really? Is this going to be the new normal going forward for laptops? This seems to at least be the case in the UK, checking the US website it comes with a 20W USB-C PSU.

2

0

James Forshaw

@tiraniddo@infosec.exchange · Feb 26, 2026

Boosted by

Greg Bell @ferrix@mastodon.online

My final blog related to admin protection is up. https://projectzero.google/2026/02/gphfh-deep-dive.html I go into a bit of history of the interesting GetProcessHandleFromHwnd API, how it ended up allow you to bypass protected process restrictions and how it's now "fixed".

21

1

17

0

James Forshaw

@tiraniddo@infosec.exchange · Feb 22, 2026

@rupert@mastodon.nz @GossiTheDog@cyberplace.social yeah I'm sure it'll be fine, it was mostly in jest, but you never know. That said, I'm going to do my best to never need to travel there again, which is somewhat hard in the tech industry.

mastodon.nz

Rupert V/ (@rupert@mastodon.nz) - Mastodon NZ

0

James Forshaw

@tiraniddo@infosec.exchange · Feb 21, 2026

@GossiTheDog@cyberplace.social I so dislike going through US immigration. Even with a green card I felt I was one CBP officer's or computer's bad day away from being locked up. I finally decided to give up the greencard once I'd been out for 12 months to give me one less thing to worry about if I have to unfortunately travel there for work. Though no doubt I'll now get questions on why I'd relinquish such a valuable opportunity to become a citizen of the greatest country in the world.

cyberplace.social

Kevin Beaumont (@GossiTheDog@cyberplace.social) - Cyberplace

4

0

James Forshaw

@tiraniddo@infosec.exchange · Feb 16, 2026

@0x00string@infosec.exchange they're trying, in the UK I can no longer use "social media" parts of xbox live without verifying my ID. As I have no friends that really doesn't bother me. But I do wonder how long until they do something I do care about. I can apparently play mature content fine, it's only the online aspects, for now.

What's crazy is the MS account is a US one, paid for by a US CC and yet because the xbox is sitting in the UK they apply the stupid rules.

infosec.exchange

Nullstring 🏴‍☠️ (@0x00string@infosec.exchange) - Infosec Exchange

0

1

0

James Forshaw

@tiraniddo@infosec.exchange · Feb 13, 2026

Released the second part of my blog post series on Admin Protection. This time it's about how most of the bugs I found came about due to abusing UI Access which was overlooked as UAC bypasses because, well, they were UAC bypasses. https://projectzero.google/2026/02/windows-administrator-protection.html

17

0

9

0

James Forshaw

@tiraniddo@infosec.exchange · Feb 11, 2026

RE: @pheonix@hachyderm.io

FFS

8

2

5

0

James Forshaw

@tiraniddo@infosec.exchange · Jan 26, 2026

My first blog post on Windows Administrator Protection is out. https://projectzero.google/2026/26/windows-administrator-protection.html probably the most interesting and complex bug out of the 9 I found, but that doesn't mean the rest weren't interesting as well, stay tuned :D

45

2

31

0

James Forshaw

@tiraniddo@infosec.exchange · Dec 16, 2025

Project Zero have finally got around to updating the blog to something less blogger-esc, check it out at https://projectzero.google. To coincide with this momentous occasion I dug out the draft of my blog post about Windows Object Manager performance which became the basis of my article in PoC||GTFO #13 and updated it to see if it still worked in Windows 11. You can read it at https://projectzero.google/2025/12/windows-exploitation-techniques.html

16

0

10

0

James Forshaw

@tiraniddo@infosec.exchange · Nov 20, 2025

Boosted by

Greg Bell @ferrix@mastodon.online

Testament to a Man's Hubris: Unknown Contractor 2024.

4

0

1

0

James Forshaw

@tiraniddo@infosec.exchange · Jul 05, 2023

Replying to @gsuberland@chaos.social

@gsuberland the problem is, fireworks have a nice, nostalgic smell which welcomes in the season. A blown tant, less so.

1

0

James Forshaw

Posts

Windows Bug Class: Accessing Trapped COM Objects with IDispatch

Kevin Beaumont (@GossiTheDog@cyberplace.social) - Cyberplace

lcamtuf :verified: :verified: :verified: (@lcamtuf@infosec.exchange) - Infosec Exchange

Rupert V/ (@rupert@mastodon.nz) - Mastodon NZ

Kevin Beaumont (@GossiTheDog@cyberplace.social) - Cyberplace

Nullstring 🏴‍☠️ (@0x00string@infosec.exchange) - Infosec Exchange

Remote instance

Media