DCOM Exec
Last updated
Last updated
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
For more info about this technique chech the original post from
Distributed Component Object Model (DCOM) objects present an interesting capability for network-based interactions with objects. Microsoft provides comprehensive documentation for both DCOM and Component Object Model (COM), accessible and . A list of DCOM applications can be retrieved using the PowerShell command:
The COM object, , enables scripting of MMC snap-in operations. Notably, this object contains a ExecuteShellCommand
method under Document.ActiveView
. More information about this method can be found . Check it running:
This feature facilitates the execution of commands over a network through a DCOM application. To interact with DCOM remotely as an admin, PowerShell can be utilized as follows:
This command connects to the DCOM application and returns an instance of the COM object. The ExecuteShellCommand method can then be invoked to execute a process on the remote host. The process involves the following steps:
Check methods:
Get RCE:
Two specific objects, ShellBrowserWindow
and ShellWindows
, were highlighted due to their lack of explicit Launch Permissions. The absence of a LaunchPermission
registry entry under HKCR:\AppID\{guid}
signifies no explicit permissions.
For ShellWindows
, which lacks a ProgID, the .NET methods Type.GetTypeFromCLSID
and Activator.CreateInstance
facilitate object instantiation using its AppID. This process leverages OleView .NET to retrieve the CLSID for ShellWindows
. Once instantiated, interaction is possible through the WindowsShell.Item
method, leading to method invocation like Document.Application.ShellExecute
.
Example PowerShell commands were provided to instantiate the object and execute commands remotely:
Two tools are highlighted for automating these techniques:
Invoke-DCOM.ps1: A PowerShell script provided by the Empire project that simplifies the invocation of different methods for executing code on remote machines. This script is accessible at the Empire GitHub repository.
SharpLateral: A tool designed for executing code remotely, which can be used with the command:
For more info about this technique check the original post
The MMC20.Application object was identified to lack explicit "LaunchPermissions," defaulting to permissions that permit Administrators access. For further details, a thread can be explored , and the usage of ’s OleView .NET for filtering objects without explicit Launch Permission is recommended.
Lateral movement can be achieved by exploiting DCOM Excel objects. For detailed information, it's advisable to read the discussion on leveraging Excel DDE for lateral movement via DCOM at .
The Empire project provides a PowerShell script, which demonstrates the utilization of Excel for remote code execution (RCE) by manipulating DCOM objects. Below are snippets from the script available on , showcasing different methods to abuse Excel for RCE:
The Powershell script allows to easily invoke all the commented ways to execute code in other machines.
You could also use :
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.