ComDotNetExploit : Exploiting Windows Protected Process Light (PPL)

ComDotNetExploit is a Proof of Concept (PoC) tool designed to demonstrate the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection.

PPL is a security feature introduced in Windows 8.1 to protect critical processes like LSASS from unauthorized access or modification. T

his exploit bypasses code integrity checks, enabling malicious payload injection into highly protected processes

The tool operates by manipulating registry keys and utilizing the IDispatch interface to redirect COM activation to .NET objects. This allows the execution of unmanaged code in a .NET process. The key features include

• COM-to-.NET Redirection: By altering registry keys, the exploit redirects COM activation to a .NET object, enabling the loading and execution of .NET assemblies within a protected process context.
• Bypassing Code Integrity Checks: Using .NET Reflection (Assembly.Load(byte[])), the exploit circumvents SEC_IMAGE validation, allowing unsigned malicious code to be loaded into PPL processes.

The exploit targets processes like svchost.exe or LSASS, which are typically shielded by PPL protections.

To execute the exploit, users run the following command:

bashComDotNetExploit.exe <DLL Path> <Static Class Name>

This loads the specified malicious DLL into the targeted PPL process.

The PoC demonstrates a novel attack vector inspired by James Forshaw’s research on trapped COM objects and .NET reflection techniques.

The tool showcases how registry manipulation enables COM redirection, facilitating code injection into protected processes. By bypassing signature checks, it undermines PPL’s security model, posing significant risks to system integrity.

While ComDotNetExploit highlights vulnerabilities in PPL protections, it is intended solely for educational purposes. Misuse of this tool for illegal activities is strongly discouraged.

The PoC underscores the importance of improving defenses against advanced exploitation techniques targeting PPL processes.

This project draws heavily from James Forshaw’s research on exploiting .NET reflection and is licensed under MIT. It serves as a critical resource for understanding and mitigating threats against Windows Protected Process Light technology.