2017 NE Cyber - Windows COM - Research

In September, I presented at the 2017 Nebraska Cyber Security Conference about Windows COM. Below are some of the many links of research relating to Windows COM that I used to prepare for my talk as well as research mentioned in the talk.

Microsoft bulletins

• May 9, 2017—KB4019216 (Monthly Rollup)
• May 9, 2017—KB4019264 (Monthly Rollup)
• Microsoft Security Bulletin MS16-141
• Microsoft Security Advisory 906267
• Microsoft Security Advisory 911052
• Microsoft Security Advisory 903144
• Microsoft Security Bulletin MS05-012
• Microsoft Security Bulletin MS04-012

Microsoft COM

Understanding and Using COM Threading Models

INFO: Descriptions and Workings of OLE Threading Models

COM in plain C

The Art of Becoming TrustedInstaller

RegistrationFreeCOM

Impersonation and MS14-027

COM Objects and Interfaces

Lateral Movement using Excel.Application and DCOM

Bypassing VirtualBox Process Hardening on Windows

UAC 0Day, All Day

Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)

COM Scriptlets

"Bypassing" Microsoft's Patch for CVE-2017-0199

HIRBSecConf 2009 - Mark Dowd - Attacking Interoperability

The .NET Inter-Operability Operation