2017 NE Cyber - Windows COM - Research

In September, I presented at the 2017 Nebraska Cyber Security Conference about Windows COM. Below are some of the many links of research relating to Windows COM that I used to prepare for my talk as well as research mentioned in the talk.

Microsoft bulletins

• May 9, 2017—KB4019216 (Monthly Rollup)
• May 9, 2017—KB4019264 (Monthly Rollup)
• Microsoft Security Bulletin MS16-141
• Microsoft Security Advisory 906267
• Microsoft Security Advisory 911052
• Microsoft Security Advisory 903144
• Microsoft Security Bulletin MS05-012
• Microsoft Security Bulletin MS04-012

Microsoft COM

Understanding and Using COM Threading Models

INFO: Descriptions and Workings of OLE Threading Models

COM in plain C

The Art of Becoming TrustedInstaller

RegistrationFreeCOM

Impersonation and MS14-027

COM Objects and Interfaces

Lateral Movement using Excel.Application and DCOM

Bypassing VirtualBox Process Hardening on Windows

UAC 0Day, All Day

Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)

COM Scriptlets

"Bypassing" Microsoft's Patch for CVE-2017-0199

HIRBSecConf 2009 - Mark Dowd - Attacking Interoperability

The .NET Inter-Operability Operation

2017 Nebraska Cyber Security Conference

Last week I presented at the 2017 Nebraska Cyber Security Conference which was a lot of fun! I presented an “Intro to Windows COM” to discuss the world of Windows COM and to bridge the gap of current talks and research. There was a lot of info thrown around, but the basics of COM were hopefully established! I will continue to aggregate all of my COM research/links and post that shortly here to my blog.

The slides for my talk are hosted at my GitHub here:

https://github.com/afreeborn/presentations/blob/master/Windows%20COM%20NE%20Cyber%202017.pdf