An0nUD4Y-Offensive-COM/README.md

# Offensive COM (Component Object Model)
> [!WARNING]
> **⚠️ AI-generated slop ahead.**
> These notes were generated by **Kimi K3 Swarms** and may contain inaccuracies, hallucinations, or outdated information. Treat them as a starting point for research—not as an authoritative reference. **Verify all technical details before relying on them.**

A complete, research-grade knowledge base on **Windows COM (Component Object Model) offensive security**, built for red teamers who start with little or no COM background and want to end up able to hunt for **zero-days** on their own.

Every chapter goes from *"what is a CLSID"* to *"here is how to fuzz marshaled NDR buffers against a SYSTEM COM server"* — with exact CLSIDs, registry paths, API signatures, runnable lab snippets, 28 purpose-built technical diagrams, per-technique detection guidance, and a **Research Lab** at the end of every attack category that turns the chapter into a repeatable hunting methodology.


> **Legal:** This material is for authorized security testing, research, and defense only. Every technique here is published defensive knowledge drawn from the public research record (Project Zero, vendor advisories, conference talks, vendor blogs). Running any of it against systems you do not own or lack written authorization to test is illegal in most jurisdictions. You are responsible for your own lab.
>
> **Provenance:** All facts, CLSIDs, CVEs, code snippets, and URLs in these chapters come from six cross-verified research briefs (kept in `research/`). Anything the sources could not double-confirm is explicitly marked **"(verify in lab)"** or carries a confidence label. Nothing is invented.

> Powered By 🤖 Kimi K3 Max Swarm

---

## How to use this knowledge base

**If you are new to COM (the "zero to hero" path):**
Read `01` cover to cover first. It defines every term, walks the registry layout, activation, marshaling, apartments, monikers, and the security model. Then read the attack chapters in order — each one re-explains what it needs before going deep.

**If you are an operator preparing for an engagement:**
Jump straight to the attack chapter you need. Each technique follows a fixed template: mechanics → prerequisites table → proof of concept → OpSec & detection → mitigations. Check `07` (Detection Engineering) against your target's likely telemetry before choosing a technique.

**If you want to find new bugs (the researcher path):**
Read `01`, then the **Research Lab** section at the end of each attack chapter (`02`–`06`), then `08` — the capstone — which assembles the full pipeline: enumeration → triage → static RE → dynamic harness → fuzzing → primitive → weaponization → reporting.

---

## File map

| File | What it covers | Diagrams |
|---|---|---|
| `01-com-fundamentals.md` | The whole COM machine: vtables, IUnknown/IDispatch, GUIDs, HKCR merged view (HKCU wins), CLSID/AppID/Interface/TypeLib registry anatomy, activation (in-proc/OOP/remote/moniker), marshaling & OBJREF/MEOW, apartments, ROT, the security model, elevation bridge, WinRT/.NET, attack-surface map, tooling & lab | d01–d08 |
| `02-dcom-lateral-movement.md` | DCOM remoting on the wire; MMC20.Application, ShellWindows, ShellBrowserWindow, Excel (DDE/RegisterXLL/ExecuteExcel4Macro), Outlook + DotNetToJScript, Visio/PowerPoint, mobsync; impacket dcomexec / SharpMove / Cobalt Strike; KB5004442 hardening; detection | d05, d09–d11 |
| `03-com-privilege-escalation.md` | The impersonation contract and its 6 failure modes; DiagHub & USO case studies; DCOM NTLM reflection (CVE-2015-2370) and the 2015→2023 hardening timeline; the complete Potato family (Rotten → Juicy → Rogue → PrintSpoofer → Sweet → JuicyNG → LocalPotato → GodPotato/DCOMPotato…) with build ranges and a decision tree; Trapped COM objects (2025) & PPL injection; other COM LPE CVEs | d06, d12–d17 |
| `04-com-uac-bypass.md` | UAC internals (split tokens, integrity levels, AppInfo); elevation moniker & auto-elevation; registry hijacks (fodhelper/eventvwr/sdclt/computerdefaults/WSReset); elevated COM objects (CMSTPLUA/ICMLuaUtil, IFileOperation, ElevatedFactoryServer→Task Scheduler); DLL hijacks, mock dirs, SilentCleanup, token abuse, CVE-2019-1388; UACME | d07, d18–d20 |
| `05-com-persistence.md` | Per-user COM hijacking (HKCU shadowing), documented CLSID cases (eventvwr, MMDeviceEnumerator/APT28, MruPidlList/ComRAT), scheduled-task ComHandler, TreatAs redirection (Turla), **TypeLib hijacking incl. the `script:` moniker and the 2025 ReliaQuest/Black Basta in-the-wild case**, phantom objects, pass-through proxy DLLs (full C++ skeleton); tooling & detection | d03, d21–d22 |
| `06-com-execution-defense-evasion.md` | Squiblydoo scriptlets, DotNetToJScript + AMSI, LOLBIN COM execution table, PPL injection via typelib type-confusion & IRundown::DoCallback, trapped COM + ForsHops, DCOM↔NTLM relay (RemotePotato0, RemoteMonologue; "relay FROM DCOM, not TO DCOM"), detection master list, MITRE mapping | d23–d25 |
| `07-detection-engineering.md` | Why COM detection is hard; Sysmon/Security/ETW telemetry primer; per-family detection (LM/LPE/UAC/persistence/execution); layered coverage matrix; evasion notes; mitigations & hardening master list | d26 |
| `08-zero-day-research-capstone.md` | The full hunting pipeline: enumeration (OleViewDotNet deep usage, registry sweeps, incendium.rocks automation) → triage scoring → static RE (VTable symbolization, NDR proxy decompilation) → dynamic harness → fuzzing marshal paths → primitive proof → weaponization → MSRC/ZDI reporting; open research backlog; master tooling table; master reading list | d27–d28 |
| `diagrams/` | 28 technical diagrams (PNG, ≥1400px) + `_contact_sheet.png` montage | — |
| `research/` | The six raw research briefs (R1 internals, R2 lateral movement, R3 privesc, R4 UAC, R5 persistence, R6 execution/evasion) the chapters were built from — keep them as an appendix/deeper reference | — |

---

## The Research Lab convention

Every attack chapter ends with a **Research Lab** section structured the same way:

1. **Hunting hypothesis** — what class of *new* bugs this category still hides
2. **Enumeration** — concrete commands/scripts to build a target list
3. **Triage heuristics** — "a target is promising if…"
4. **Analysis workflow** — static RE checklist + dynamic harness sketch
5. **Fuzzing / mutation ideas** — typed argument mutation for this category
6. **From crash/lead to primitive** — how to prove exploitability
7. **Further reading** — curated links

Work through them in order and you have a complete, repeatable zero-day methodology.

## Diagram index

`d01` activation flow · `d02` in-proc vs OOP trust boundary · `d03` HKCR merge · `d04` marshaling & OBJREF · `d05` DCOM on the wire · `d06` impersonation contract · `d07` elevation moniker · `d08` attack-surface map · `d09` DCOM lateral anatomy · `d10` MMC20 chain · `d11` ShellWindows chain · `d12` missing impersonation · `d13` DiagHub chain · `d14` RottenPotato · `d15` RoguePotato · `d16` potato lineage · `d17` trapped objects · `d18` UAC auto-elevation · `d19` IFileOperation chain · `d20` CMSTPLUA chain · `d21` per-user hijack · `d22` TreatAs & TypeLib · `d23` Squiblydoo · `d24` PPL injection · `d25` relay chain · `d26` telemetry map · `d27` research pipeline · `d28` fuzzing harness

## Conventions used in all chapters

- `> **Beginner note:**` — term defined on first use · `> **Key idea:**` — the insight to remember · `> **Warning:**` — patch-status/version uncertainty · `> **OpSec:**` — detection trade-offs · `> **Legal:**` — authorization reminders
- All CLSIDs/GUIDs, registry paths, and API names in `backticks`, character-exact against the source research.
- `*(illustrative)*` marks lab scaffolding written for this course (not from a cited source); `(verify in lab)` marks claims the sources could not double-confirm.
- References are numbered per chapter and cited inline as `([N])`.

*Built July 2026. Windows behavior changes between builds — always re-verify patch status and CLSID presence on your specific target version.*