Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Injecting Code into Windows Protected Processes using COM - Part 1

projectzero.google | blog | #windows | #code-injection | #project-zero | #com | #protected-process

Summary

At Recon Montreal 2018 I presented “Unknown Known DLLs and other Code Integrity Trust Violations” with Alex Ionescu. We described the implementation of Microsoft Windows’ Code Integrity mechanisms and how Microsoft implemented Protected Processes (PP). As part of that I demonstrated various ways of bypassing Protected Process Light (PPL), some requiring administrator privileges, others not.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Injecting Code into Windows Protected Processes using COM - Part 2
In my previous blog I discussed a technique which combined numerous issues I’ve previously reported to Microsoft to inject arbitrary code into a PPL-WindowsTCB process. The techniques presented don’t work for exploiting the older, stronger Protected Processes (PP) for a few different reasons. This blog seeks to remedy this omission and provide details of how I was able to also hijack a full PP-WindowsTCB process without requiring administrator privileges. This is mainly an academic exercise, to see whether I can get code executing in a full PP as there’s not much more you can do inside a PP over a PPL.
blog · projectzero.google
Dude, where’s my heap?
A Google Project Zero post examining heap spraying and heap address randomization, and how browser exploits can still succeed against them.
blog · projectzero.google
In-Console-Able
A Google Project Zero post describing a Windows security bug that weakens sandbox-style restrictions and could aid sandbox escape research.
vulnerability · projectzero.google
Internet Explorer EPM Sandbox Escape CVE-2014-6350
A Google Project Zero post detailing exploitation of CVE-2014-6350 to escape Internet Explorer's Enhanced Protected Mode sandbox.
research · projectzero.google
[CVE-2014-3196] Did the “Man With No Name” Feel Insecure?
A Google Project Zero post on CVE-2014-3196, a Windows Chrome bug fixed in M38 that served as an early link in a potential exploit chain.
blog · projectzero.google
Windows Bug Class: Accessing Trapped COM Objects with IDispatch
Documentation of a Windows bug class where trapped COM objects become reachable through IDispatch, enabling access across intended boundaries, with mitigation guidance.
back