Exploiting Windows COM/WinRT Services
Conference: BlackHat USA 2021
2021-08-05
Summary
The presentation discusses vulnerabilities in the Silicon Thread Model and provides solutions for exploiting them.
- The presentation highlights vulnerabilities related to the Cons 36 Constraint Safety and provides a spray approach for the Mobius COM enemy RT.
- The presentation explains how to exploit the tab confusion bug in the IHRML Document interface function.
- The presentation discusses the vulnerability refund issue in the IWhatIsCustomProperty interface.
- The presentation provides solutions for exploiting these vulnerabilities, including using the hip spring to achieve code execution and creating multiple IWhatIsCustomProperty objects to write arbitrary data.
Abstract
The Component Object Model (COM) and Windows Runtime (WinRT) are widely used in windows systems, they are often used for cross-process communication and UWP Application. Both of them provide large attack surfaces for hackers to hunt for LPE, RCE and Sandbox Escape vulnerabilities. In the past year, we have found more than 100 bugs in COM/WinRT service. We classify these vulnerabilities according to their different types (UAF, OOB READ/WRITE, Type Confusion, Arbitrary READ/WRITE). We'll share how we found these bugs and our exploit tricks for some of these bugs.
Materials:
Tags:
Post a comment
Related work
Conference: Defcon 31
Authors: Bohan Liu Senior Security Researcher, Tencent, GuanCheng Li Senior Security Researcher at Tencent Security Xuanwu Lab, Zheng Wang Senior Security Researcher at Tencent Security Xuanwu Lab
2023-08-01