Enumerating COM Objects and their Methods

Red Teaming Experiments

linkedin twitter patreon github

Search…

What is ired.team?

Pinned

Pentesting Cheatsheets

Active Directory & Kerberos Abuse

reversing, forensics & misc

Internals

Cloud

Neo4j

Dump Virtual Box Memory

AES Encryption Using Crypto++ .lib in Visual Studio C++

Reversing Password Checking Routine

Enumerating COM Objects and their Methods

This is a quick note to capture some of the commands for finding interesting COM objects and the methods they expose, based on the great article from Fireeye.
The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact
​https://docs.microsoft.com/en-us/windows/win32/com/the-component-object-model​
This is less of a post-exploitation technique, rather a method that allows one to look for interesting COM objects, that could be leveraged by one's malware.
Enumerating COM Objects
We can find all the COM objects registered on the Windows system with:
gwmi Win32_COMSetting | ? {$_.progid } | sort | ft ProgId,Caption,InprocServer32
Enumerating COM Object Methods
Once we have the list of COM objects and have identified an interesting COM object, we can now check the methods it exposes. In our case, let's pick a COM object WScript.Shell.1 and check its methods like so:
$o = [activator]::CreateInstance([type]::GetTypeFromProgID(("WScript.Shell.1"))) | gm
Below are the methods exposed by WScript.Shell.1 COM object, one of which is RegRead:
Let's see if we can read a registry value with RedRead method exposed by the WScript.Shell.1. RedRead accepts one string as an argument - a path to the registry value:
$o.RegRead("HKEY_CURRENT_USER\Volatile Environment\LOGONSERVER")
Below shows how a registry value was read successfully:
Exposing All COM Object Methods
We can iterate through all the COM objects and list their methods and save it all to a text file that we can later on inspect for any other interesting methods:
$com = gwmi Win32_COMSetting | ? {$_.progid } | select ProgId,Caption,InprocServer32
​
$com | % {
    $_.progid | out-file -append methods.txt
    [activator]::CreateInstance([type]::GetTypeFromProgID(($_.progid))) | gm | out-file -append methods.txt
    "`n`n" | out-file -append methods.txt
}
Below shows the output file with all the methods of all COM objects exposed, in focus are the methods for Shell.Application.1 COM object:
References
Hunting COM Objects | Mandiant

Windows Event IDs and Others for Situational Awareness

Enumerating Users without net, Services without sc and Scheduled Tasks without schtasks

Last modified 2yr ago

Copy link

On this page

Enumerating COM Objects

Enumerating COM Object Methods

Exposing All COM Object Methods

References