I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to calling the functions in the COM interface?. Explanation of the research I performed and my specific questions next. I will use IFileOperation COM (CLSID = 3AD05575-8857-4850-9277-11B85BDB8E09) and ICMLuaUtil COM (CLSID = 3E5FC7F9-9A51-4367-9063-A120244FBEC7) as an example in this post.
COM objects are listed in the registry under
HKEY_CLASSES_ROOT\CLSID. The default value has the COM name and the server DLL file.
Now, in order to list the interfaces associated with it I used
oleview, for IFileOperation it showed all the interfaces but for ICMLuaUtil it showed only the .
Even after I get the interface name, I have to get the function list and signatures, this can be extracted from the
idl file. A great answer presented here shows how to get from an interface name to its function signatures by examining the example code and searching for
idl file with the same name as the imports in the
sdk folder. I have tried applying similar approach with the two interfaces with partial success.
- For IFileOperation, the example source has 4 includes neither of which has exact same
idlfile in the sdk folder. So i search the content of all the files in the folder for the word
IFileOperationwhich resulted in getting the desired file:
- Unfortunately I couldn't do the same thing with
ICMLuaUtilas I don't know the interface name, I tried several name variations but got nothing.
Other methods I tried are:
- Extracting all files from the DLLs I found in the registry (nothing there)
- COMViewer should present additional information but it didn't work on my Windows 10 machine (didn't start), even with compatibility mode.
My question is how do I get from the (sometimes undocumented) COM objects to concrete interface definition so I could use it in my code? The UACMe project has a concrete definition of the interface for
ICMLuaUtil, so there must be a method to obtain it. What are the guidelines and steps to obtain those function signatures?
IUnknownand both the documentation (MSDN) as well as several books explain in great detail how to instantiate COM objects. However, those are all non-RCE topics. Whether there is an interface definition (IDL or otherwise) solely depends on the author. After all COM is meant to allow black-box objects to interact with each other. Only caller and callee need to know.
ICMLuaUtil, where I got no interface name/idl file, how can I get the IID and how to figure out the method signatures for it? it was done before, and I wish to learn how to reproduce the results (github.com/hfiref0x/UACME/blob/…)