Exploitation Tools

ComDotNetExploit : Exploiting Windows Protected Process Light (PPL)

ComDotNetExploit is a Proof of Concept (PoC) tool designed to demonstrate the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection.

PPL is a security feature introduced in Windows 8.1 to protect critical processes like LSASS from unauthorized access or modification. T

his exploit bypasses code integrity checks, enabling malicious payload injection into highly protected processes

The tool operates by manipulating registry keys and utilizing the IDispatch interface to redirect COM activation to .NET objects. This allows the execution of unmanaged code in a .NET process. The key features include

  • COM-to-.NET Redirection: By altering registry keys, the exploit redirects COM activation to a .NET object, enabling the loading and execution of .NET assemblies within a protected process context.
  • Bypassing Code Integrity Checks: Using .NET Reflection (Assembly.Load(byte[])), the exploit circumvents SEC_IMAGE validation, allowing unsigned malicious code to be loaded into PPL processes.

The exploit targets processes like svchost.exe or LSASS, which are typically shielded by PPL protections.

To execute the exploit, users run the following command:

bashComDotNetExploit.exe <DLL Path> <Static Class Name>

This loads the specified malicious DLL into the targeted PPL process.

The PoC demonstrates a novel attack vector inspired by James Forshaw’s research on trapped COM objects and .NET reflection techniques.

The tool showcases how registry manipulation enables COM redirection, facilitating code injection into protected processes. By bypassing signature checks, it undermines PPL’s security model, posing significant risks to system integrity.

While ComDotNetExploit highlights vulnerabilities in PPL protections, it is intended solely for educational purposes. Misuse of this tool for illegal activities is strongly discouraged.

The PoC underscores the importance of improving defenses against advanced exploitation techniques targeting PPL processes.

This project draws heavily from James Forshaw’s research on exploiting .NET reflection and is licensed under MIT. It serves as a critical resource for understanding and mitigating threats against Windows Protected Process Light technology.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

ROADTools: The Modern Azure AD Exploration Framework

ROADTools is a powerful framework designed for exploring and interacting with Microsoft Azure Active Directory…

9 hours ago

How to Enumerate Microsoft 365 Groups Using PowerShell and Python

Microsoft 365 Groups (also known as M365 Groups or Unified Groups) are at the heart…

9 hours ago

SeamlessPass: Using Kerberos Tickets to Access Microsoft 365

SeamlessPass is a specialized tool designed to leverage on-premises Active Directory Kerberos tickets to obtain…

1 day ago

PPLBlade: Advanced Memory Dumping and Obfuscation Tool

PPLBlade is a powerful Protected Process Dumper designed to capture memory from target processes, hide…

1 day ago

HikPwn : Simple Scanner For Hikvision Devices With Basic Vulnerability Scanning

HikPwn: Comprehensive Guide to Scanning Hikvision Devices for Vulnerabilities If you’re searching for an efficient…

2 days ago

Comments in Bash Scripts

What Are Bash Comments? Comments in Bash scripts, are notes in your code that the…

1 week ago