{"id":13842789,"url":"https://github.com/nccgroup/acCOMplice","last_synced_at":"2025-07-11T15:33:11.250Z","repository":{"id":46751942,"uuid":"206433565","full_name":"nccgroup/acCOMplice","owner":"nccgroup","description":"Tools for discovery and abuse of COM hijacks","archived":false,"fork":false,"pushed_at":"2019-10-15T21:54:09.000Z","size":38807,"stargazers_count":289,"open_issues_count":0,"forks_count":46,"subscribers_count":15,"default_branch":"master","last_synced_at":"2024-11-18T00:05:35.251Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nccgroup.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-09-04T23:32:09.000Z","updated_at":"2024-11-05T13:28:25.000Z","dependencies_parsed_at":"2022-08-12T13:01:09.035Z","dependency_job_id":null,"html_url":"https://github.com/nccgroup/acCOMplice","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nccgroup%2FacCOMplice","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nccgroup%2FacCOMplice/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nccgroup%2FacCOMplice/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nccgroup%2FacCOMplice/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nccgroup","download_url":"https://codeload.github.com/nccgroup/acCOMplice/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225737142,"owners_count":17516296,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:46.240Z","updated_at":"2024-11-21T13:31:10.609Z","avatar_url":"https://github.com/nccgroup.png","language":"PowerShell","funding_links":[],"categories":["PowerShell","PowerShell (153)"],"sub_categories":[],"readme":"# acCOMplice\n\n_Your COM hijacking accomplice_\n\nAuthor: David Tulis ([@kafkaesqu3](https://twitter.com/kafkaesqu3))\n\n## Overview\n\nThis repository contains code samples and proofs-of-concept for exploring COM\nhijacking. COM hijacking is a Windows post exploitation technique, which can be\nused for persistence or defense evasion. \n\nFor more information on the COM interface, how to find hijacks, and techniques\nfor abusing a hijack, please refer to the presentation given at Derbycon 9,\n_COM Hijacking Techniques_.\n\n* Slides: \u003chttps://www.slideshare.net/DavidTulis1/com-hijacking-techniques-derbycon-2019\u003e\n* Presentation: \u003chttps://www.youtube.com/watch?v=pH14BvUiTLY\u003e\n\n## Project\n\n* **COMHijackToolkit:** Powershell script containing helper scripts for dealing\n                        with COM hijacks. Quick highlights: \n    * `Extract-HijackableKeysFromProcmonCSV`: parses a Procmon CSV export for\n                                              hijackable objects\n    * `Hijack-CLSID`: Hijacks a CLSID with a given DLL\n    * `Hijack-MultipleKeys`: Hijacks multiple CLSDs concurrently with a given\n                             DLL. This is useful for finding CLSIDs which are\n                             activated often\n* **InjectionTemplates:** 3 templates demoed at Derbycon presentation\n    * Create a new process with `CreateProcess`\n    * Inject into an existing process with `CreateRemoteThread`\n    * Measure thread lifetimes in current process using `CreateThread`\n* **COMinject:** Proof of concept demonstrating how COM hijacks can be used to accomplish process injections/migrations\n* **masterkeys.csv:** Some keys for you to play with\n* **procmon-filters:** Filters for Procmon to aid in hijack identification and\n               exploitation\n\n## Examples\n\n### COMHijackToolkit\n\nPowershell script containing helper scripts for dealing with COM hijacks. Highlights:\n\nShow all COM object CLSIDs and the location of the implementation on disk\n```\n$keys = Get-CLSIDRegistryKeys -RegHive HKCR\n$results = $keys | % {$guid = Extract-GUIDFromText $_; Map-GUIDToDLL -guid $guid 2\u003e $null }\n```\n\nConduct a survey of CLSIDs on a system\n```\n$HKCR_keys = Get-CLSIDRegistryKeys -RegHive HKCR\n$HKCR_keys | where-object {$_ -like \"*inprocserver\"} | Measure-Object\n$HKCR_keys | where-object {$_ -like \"*inprocserver32\"} | Measure-Object\n$HKCR_keys | where-object {$_ -like \"*localserver\"} | Measure-Object\n$HKCR_keys | where-object {$_ -like \"*localserver32\"} | Measure-Object\n\n$HKLM_keys = Get-CLSIDRegistryKeys -RegHive HKLM\n$HKLM_keys | Measure-Object\n$HKCU_keys = Get-CLSIDRegistryKeys -RegHive HKCU\n$HKCU_keys | Measure-Object\n```\n```\nexplorer:{69486DD6-C19F-42e8-B508-A53F9F8E67B8}\nexplorer:{9E175B6D-F52A-11D8-B9A5-505054503030}\nexplorer:{30CC9D06-7E62-4966-9777-BC3442E788BD}\nexplorer:{3eef301f-b596-4c0b-bd92-013beafce793}\nexplorer:{682159d9-c321-47ca-b3f1-30e36b2ec8b9}\nexplorer:{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}\nexplorer:{9aa46009-3ce0-458a-a354-715610a075e6}\nexplorer:{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\nexplorer:{AC36A05C-FB95-4C7A-868C-A43CC8D2D926}\nexplorer:{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}\nexplorer:{c2f03a33-21f5-47fa-b4bb-156362a2f239}\n```\n\nFind CLSIDs referencing a DLL which does not exist on the system: \n```\nFind-MissingLibraries\n```\n\n### InjectionTemplates\n\n3 proof-of-concept templates for COM hijack abuse, as demonstrated in the\nDerbycon 9 presentation: \n\n* `HijackDLL-Process`: Create a new process when DLL is loaded\n* `HijackDLL-CreateRemoteThread`: Perform thread injection technique using\n                                  `CreateRemoteThread` API call when DLL is\n                                  loaded\n* `HijackDLL-Threads`: Useful for measuring lifetime of a threads started in the\n                       DLL after a hijack\n\n### COMinject\n\nProof of concept to show how COM hijacking can be used for process injections: \n\n* _COMInjectDotNet:_ Proof of concept client which will inject a DLL into a\n                     supported process via COM hijack\n* _COMInjectTarget:_ The target library to inject into a process\n\nThe first step is to perform the hijack:\n\n```\nCOMInjectDotNet.exe chrome.exe C:\\COM\\COMInjectTarget.dll\n```\n\nThe hijack won't trigger immediately, and may require the application to be\nstarted (if not currently running), or some basic application actions. There are\nprobably some better CLSIDs that trigger more often, but these are good enough. \n\nThe `COMInjectTarget.dll` will log its progress to a log file in `C:\\COM`. This\nappears more stable than using something like `AllocConsole` from within another\nprocess and just printing to the console.\n\nThe following shows the injected DLL running from within the main `chrome.exe`\nprocess:\n\n```\n[*] chrome pid=9104 ppid=4900 (count 0)\n[*] chrome pid=9104 ppid=4900 (count 1)\n[*] chrome pid=9104 ppid=4900 (count 2)\n[*] chrome pid=9104 ppid=4900 (count 3)\n[*] chrome pid=9104 ppid=4900 (count 4)\n[*] chrome pid=9104 ppid=4900 (count 5)\n``` \n\nThe currently supported processes are:\n\n* explorer (default)\n* chrome\n* excel\n* word\n* outlook\n\n## References and credits\nTo learn more about COM and COM hijacks: \n\n* Leo Loobeek ([@leoloobeek](https://twitter.com/leoloobeek)):\n    * [COMProxy](https://github.com/leoloobeek/COMProxy/), which I borrowed code\n      heavily from\n    * [Proxying COM For Stable Hijacks](https://adapt-and-attack.com/2019/08/29/proxying-com-for-stable-hijacks/)\n* Matt Nelson ([@enigma0x3](https://twitter.com/enigma0x3)):\n    * [Userland Persistence with Scheduled Tasks and COM Handler Hijacking](https://enigma0x3.net/2016/05/25/userland-persistence-with-scheduled-tasks-and-com-handler-hijacking/)\n* The [@bohops](https://twitter.com/bohops) series on COM hijacks:\n    * [Abusing the COM Registry Structure: CLSID, LocalServer32, \u0026 InprocServer32](https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/)\n    * [Abusing the COM Registry Structure (Part 2): Hijacking \u0026 Loading Techniques](https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/)\n* James Forshaw ([@tiraniddo](https://twitter.com/tiraniddo)):\n    * [Having Fun with COM](https://vimeo.com/showcase/5637718/video/335942580)\n    * [COM in 60 seconds](https://www.youtube.com/watch?v=dfMuzAZRGm4)\n    * [OleViewDotNet](https://github.com/tyranid/oleviewdotnet)\n* Casey Smith ([@subtee](https://twitter.com/subtee)) + [@enimga0x3](https://twitter.com/enimga0x3):\n    * [Windows Operating System Archaeology](https://www.youtube.com/watch?v=3gz1QmiMhss) ([slides](https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology), [code](https://github.com/jeperez/windows-operating-system-archaeology))\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnccgroup%2FacCOMplice","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnccgroup%2FacCOMplice","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnccgroup%2FacCOMplice/lists"}