Warning
A complete, research-grade knowledge base on Windows COM (Component Object Model) offensive security, built for red teamers who start with little or no COM background and want to end up able to hunt for zero-days on their own.
Every chapter goes from "what is a CLSID" to "here is how to fuzz marshaled NDR buffers against a SYSTEM COM server" — with exact CLSIDs, registry paths, API signatures, runnable lab snippets, 28 purpose-built technical diagrams, per-technique detection guidance, and a Research Lab at the end of every attack category that turns the chapter into a repeatable hunting methodology.
Legal: This material is for authorized security testing, research, and defense only. Every technique here is published defensive knowledge drawn from the public research record (Project Zero, vendor advisories, conference talks, vendor blogs). Running any of it against systems you do not own or lack written authorization to test is illegal in most jurisdictions. You are responsible for your own lab.
Provenance: All facts, CLSIDs, CVEs, code snippets, and URLs in these chapters come from six cross-verified research briefs (kept in
research/). Anything the sources could not double-confirm is explicitly marked "(verify in lab)" or carries a confidence label. Nothing is invented.
Powered By 🤖 Kimi K3 Max Swarm
If you are new to COM (the "zero to hero" path):
Read 01 cover to cover first. It defines every term, walks the registry layout, activation, marshaling, apartments, monikers, and the security model. Then read the attack chapters in order — each one re-explains what it needs before going deep.
If you are an operator preparing for an engagement:
Jump straight to the attack chapter you need. Each technique follows a fixed template: mechanics → prerequisites table → proof of concept → OpSec & detection → mitigations. Check 07 (Detection Engineering) against your target's likely telemetry before choosing a technique.
If you want to find new bugs (the researcher path):
Read 01, then the Research Lab section at the end of each attack chapter (02–06), then 08 — the capstone — which assembles the full pipeline: enumeration → triage → static RE → dynamic harness → fuzzing → primitive → weaponization → reporting.
| File | What it covers | Diagrams |
|---|---|---|
01-com-fundamentals.md |
The whole COM machine: vtables, IUnknown/IDispatch, GUIDs, HKCR merged view (HKCU wins), CLSID/AppID/Interface/TypeLib registry anatomy, activation (in-proc/OOP/remote/moniker), marshaling & OBJREF/MEOW, apartments, ROT, the security model, elevation bridge, WinRT/.NET, attack-surface map, tooling & lab | d01–d08 |
02-dcom-lateral-movement.md |
DCOM remoting on the wire; MMC20.Application, ShellWindows, ShellBrowserWindow, Excel (DDE/RegisterXLL/ExecuteExcel4Macro), Outlook + DotNetToJScript, Visio/PowerPoint, mobsync; impacket dcomexec / SharpMove / Cobalt Strike; KB5004442 hardening; detection | d05, d09–d11 |
03-com-privilege-escalation.md |
The impersonation contract and its 6 failure modes; DiagHub & USO case studies; DCOM NTLM reflection (CVE-2015-2370) and the 2015→2023 hardening timeline; the complete Potato family (Rotten → Juicy → Rogue → PrintSpoofer → Sweet → JuicyNG → LocalPotato → GodPotato/DCOMPotato…) with build ranges and a decision tree; Trapped COM objects (2025) & PPL injection; other COM LPE CVEs | d06, d12–d17 |
04-com-uac-bypass.md |
UAC internals (split tokens, integrity levels, AppInfo); elevation moniker & auto-elevation; registry hijacks (fodhelper/eventvwr/sdclt/computerdefaults/WSReset); elevated COM objects (CMSTPLUA/ICMLuaUtil, IFileOperation, ElevatedFactoryServer→Task Scheduler); DLL hijacks, mock dirs, SilentCleanup, token abuse, CVE-2019-1388; UACME | d07, d18–d20 |
05-com-persistence.md |
Per-user COM hijacking (HKCU shadowing), documented CLSID cases (eventvwr, MMDeviceEnumerator/APT28, MruPidlList/ComRAT), scheduled-task ComHandler, TreatAs redirection (Turla), TypeLib hijacking incl. the script: moniker and the 2025 ReliaQuest/Black Basta in-the-wild case, phantom objects, pass-through proxy DLLs (full C++ skeleton); tooling & detection |
d03, d21–d22 |
06-com-execution-defense-evasion.md |
Squiblydoo scriptlets, DotNetToJScript + AMSI, LOLBIN COM execution table, PPL injection via typelib type-confusion & IRundown::DoCallback, trapped COM + ForsHops, DCOM↔NTLM relay (RemotePotato0, RemoteMonologue; "relay FROM DCOM, not TO DCOM"), detection master list, MITRE mapping | d23–d25 |
07-detection-engineering.md |
Why COM detection is hard; Sysmon/Security/ETW telemetry primer; per-family detection (LM/LPE/UAC/persistence/execution); layered coverage matrix; evasion notes; mitigations & hardening master list | d26 |
08-zero-day-research-capstone.md |
The full hunting pipeline: enumeration (OleViewDotNet deep usage, registry sweeps, incendium.rocks automation) → triage scoring → static RE (VTable symbolization, NDR proxy decompilation) → dynamic harness → fuzzing marshal paths → primitive proof → weaponization → MSRC/ZDI reporting; open research backlog; master tooling table; master reading list | d27–d28 |
diagrams/ |
28 technical diagrams (PNG, ≥1400px) + _contact_sheet.png montage |
— |
research/ |
The six raw research briefs (R1 internals, R2 lateral movement, R3 privesc, R4 UAC, R5 persistence, R6 execution/evasion) the chapters were built from — keep them as an appendix/deeper reference | — |
Every attack chapter ends with a Research Lab section structured the same way:
- Hunting hypothesis — what class of new bugs this category still hides
- Enumeration — concrete commands/scripts to build a target list
- Triage heuristics — "a target is promising if…"
- Analysis workflow — static RE checklist + dynamic harness sketch
- Fuzzing / mutation ideas — typed argument mutation for this category
- From crash/lead to primitive — how to prove exploitability
- Further reading — curated links
Work through them in order and you have a complete, repeatable zero-day methodology.
d01 activation flow · d02 in-proc vs OOP trust boundary · d03 HKCR merge · d04 marshaling & OBJREF · d05 DCOM on the wire · d06 impersonation contract · d07 elevation moniker · d08 attack-surface map · d09 DCOM lateral anatomy · d10 MMC20 chain · d11 ShellWindows chain · d12 missing impersonation · d13 DiagHub chain · d14 RottenPotato · d15 RoguePotato · d16 potato lineage · d17 trapped objects · d18 UAC auto-elevation · d19 IFileOperation chain · d20 CMSTPLUA chain · d21 per-user hijack · d22 TreatAs & TypeLib · d23 Squiblydoo · d24 PPL injection · d25 relay chain · d26 telemetry map · d27 research pipeline · d28 fuzzing harness
> **Beginner note:**— term defined on first use ·> **Key idea:**— the insight to remember ·> **Warning:**— patch-status/version uncertainty ·> **OpSec:**— detection trade-offs ·> **Legal:**— authorization reminders- All CLSIDs/GUIDs, registry paths, and API names in
backticks, character-exact against the source research. *(illustrative)*marks lab scaffolding written for this course (not from a cited source);(verify in lab)marks claims the sources could not double-confirm.- References are numbered per chapter and cited inline as
([N]).
Built July 2026. Windows behavior changes between builds — always re-verify patch status and CLSID presence on your specific target version.