Windows Exploitation Techniques: Dangling COM Object Registrations
A Microsoft bug, dubbed "Dark Elevator," allows privilege escalation on Windows systems. This vulnerability stems from a dangling COM object registration for the CrossDevice COM object, where a server DLL is missing. Microsoft has since fixed this issue, but a workaround exists: abusing custom COM marshaling. By sending a malicious COM object with a fake marshaler, an attacker can force an arbitrary DLL to be loaded into a privileged process, leading to code execution. The original vulnerability was exploited by a service called Shell Create Object Handler, which runs as SYSTEM but doesn't enable custom marshaling by default. A PowerShell script is provided to identify other potential dangling COM servers.
This short blog post details a privilege escalation vulnerability in Windows, recently addressed by Microsoft. The issue, known as "Dark Elevator," is caused by a dangling COM object registration for the CrossDevice COM object. Specifically, a server DLL is missing, leading to a situation where an attacker can create an arbitrary DLL in a common system directory (C:\ProgramData) and then instantiate a COM object that loads it into a privileged process.
What happened
The root cause is a missing server executable for the CrossDevice COM object. Normally, COM object registration requires a server executable and a CLSID entry under HKEY_CLASSES_ROOT. However, in this case, the server DLL is absent. Microsoft previously fixed this issue with CVE-2026-50343, which involved a weak registry key permissions exploit to add the class as a installer plugin and then get the InstallService to load it into memory. However, the fix didn't address the underlying problem, and a workaround remains.
Technical details
The vulnerability is triggered by abusing custom COM marshaling. When a COM object is passed to a server process, the COM runtime marshals it into an OBJREF structure. This allows the object to be used in the server. The key is that if a parameter is a COM object, the runtime marshals it into an OBJREF structure, which allows an arbitrary DLL to be loaded into a privileged process. The default COM marshaling strategy is by reference, which produces a Standard OBJREF containing all the information needed to connect to the original object.
Microsoft has implemented mitigations to prevent custom marshaling, including EOAC_NO_CUSTOM_MARSHAL capabilities flag when calling CoInitializeSecurity and setting the COMGLB_UNMARSHALING_POLICY property type through the IGlobalOptions::Set method. However, the vulnerability persists because the Shell Create Object Handler service, which runs as SYSTEM, doesn't enable these mitigations by default.
Impact
This vulnerability can lead to privilege escalation, allowing an attacker to execute arbitrary code with SYSTEM privileges. The scope is potentially widespread, affecting any Windows system running vulnerable versions of Windows. The real-world risk is significant, as it could enable attackers to install malware, steal sensitive data, or compromise system security.
What to do
- **Enable Mitigation:** Microsoft recommends enabling the EOAC_NO_CUSTOM_MARSHAL capabilities flag when calling CoInitializeSecurity. This prevents custom marshaling unless explicitly opted in.
- **Monitor for Vulnerable Services:** Regularly scan for services that might be vulnerable, as described in the blog post.
- **Patch:** Ensure that all systems are updated to the latest version of Windows to receive the latest security patches.
- **Implement a Vulnerability Management Program:** Regularly scan for and remediate vulnerabilities.
Why it matters
This vulnerability highlights the importance of understanding COM object registration and marshaling. It also demonstrates how seemingly minor issues in COM can lead to significant security risks. The existence of a workaround underscores the need for proactive security measures and continuous monitoring of system vulnerabilities. The blog post provides a valuable tool for security professionals to identify and address potential vulnerabilities on their systems.