如何使用COMThanasia对COM对象执行安全审计

git clone https://github.com/CICADA8-Research/COMThanasia.git

PS A:mzhmo> .PermissionHunter.exe -h                     ,                `-.       .-'        ,-"`````""-__ |  /         '-.._    _.-'` '-o,             _>--:{{<   ) |)         .-''      '-.__.-o`        '-._____..-/`  |                  ,-'   /    `-.                      `  PermissionHunter - hunt for incorrect LaunchPermission and ActivatePermission        CICADA8 Research Team        From Michael Zhmaylo (MzHmO)PermissionHunter.exeSmall tool that allows you to find vulnerable COM objects with incorrect LaunchPermission and ActivatePermission[OPTIONS]-outfile : output filename-outformat : output format. Accepted 'csv' and 'xlsx'-h/--help : shows this windows

PS A:mzhmo> .PermissionHunter -outfile result -outformat xlsx                     ,                `-.       .-'        ,-"`````""-__ |  /         '-.._    _.-'` '-o,             _>--:{{<   ) |)         .-''      '-.__.-o`        '-._____..-/`  |                  ,-'   /    `-.                      `  PermissionHunter - hunt for incorrect LaunchPermission and ActivatePermission        CICADA8 Research Team        From Michael Zhmaylo (MzHmO)[+] Result will be in result, format xlsx[+] Success

.ComDiver.exe --no-create

PS A:ssdgitrepoCOMThanasiaMonikerHoundx64Debug> .MonikerHound.exe          ,_  _  _,            o-o/           ,(.-.),         _/ |) (| _           /=-=/          ,| =/ |,        _/   |  / _            _!_/ MonikerHound - find your own UAC Bypass!         CICADA8 Research Team         From Michael Zhmaylo (MzHmO)[+] Potential COM server for elevation moniker found!Name: CEIPLuaElevationHelperCLSID: {01D0A625-782D-4777-8D4E-547E6457FAD5}LocalizedString: @%systemroot%system32werconcpl.dll,-351Enabled: 1IconReference: @%systemroot%system32werconcpl.dll,-6Activate: SuccessPID: 15800DllHost.exe[+]........................[+][+] Potential COM server for elevation moniker found!Name: CTapiLuaLib ClassCLSID: {03e15b2e-cca6-451c-8fb0-1e2ee37a27dd}LocalizedString: @%systemroot%system32tapiui.dll,-1Enabled: 1IconReference: @%systemroot%system32tapiui.dll,-201Activate: SuccessPID: 440DllHost.exe[+]........................[+]

PS A:ssdgitrepoCOMThanasiaClsidExplorerx64Debug> .CLSIDExplorer.exe -hCLSIDExplorer.exe - identify all info by clsidUsage:.CLSIDExplorer.exe --clsid "{00000618-0000-0010-8000-00aa006d2ea4}"

PS A:ssdgitrepoCOMThanasiaClsidExplorerx64Debug> .CLSIDExplorer.exe --clsid "{00000618-0000-0010-8000-00aa006d2ea4}"[{00000618-0000-0010-8000-00aa006d2ea4}]        AppID: Unknown        ProgID: Unknown        PID: 1572        Process Name: CLSIDExplorer.exe        Username: WINPC\Michael        Methods:        [0] __stdcall void QueryInterface(IN GUID*, OUT void**)        [1] __stdcall unsigned long AddRef()        [2] __stdcall unsigned long Release()        [3] __stdcall void GetTypeInfoCount(OUT unsigned int*)        [4] __stdcall void GetTypeInfo(IN unsigned int, IN unsigned long, OUT void**)        [5] __stdcall void GetIDsOfNames(IN GUID*, IN char**, IN unsigned int, IN unsigned long, OUT long*)        [6] __stdcall void Invoke(IN long, IN GUID*, IN unsigned long, IN unsigned short, IN DISPPARAMS*, OUT VARIANT*, OUT EXCEPINFO*, OUT unsigned int*)        [7] __stdcall BSTR Name()        [8] __stdcall void Name(IN BSTR)        [9] __stdcall RightsEnum GetPermissions(IN VARIANT, IN ObjectTypeEnum, IN VARIANT)        [10] __stdcall void SetPermissions(IN VARIANT, IN ObjectTypeEnum, IN ActionEnum, IN RightsEnum, IN InheritTypeEnum, IN VARIANT)        [11] __stdcall void ChangePassword(IN BSTR, IN BSTR)        [12] __stdcall Groups* Groups()        [13] __stdcall Properties* Properties()        [14] __stdcall _Catalog* ParentCatalog()        [15] __stdcall void ParentCatalog(IN _Catalog*)        [16] __stdcall void ParentCatalog(IN _Catalog*)[END]

PS A:SSDgitrepoCOMThanasiaComTravellerx64Debug> .ComTraveller.exe -h        ,,_       zd$$??=     z$$P? F:`c,                _    d$$, `c'cc$$i           ,cd$?R   $$$$ cud$,?$$$i       ,=P"2?z "    $" " ?$$$,?$$$.    ,-''`>, bzP     'cLdb,?$$,?$$$   ,h' "I$'J$P  ... `?$$$,"$$,`$$h  $$PxrF'd$"d$PP""?-,"?$$,?$h`$$,,$$'$F44"?,,_`=4c,?=,"?hu?$`?L4$'? '   `""?==""=-"" `""-`'_,,,,           .ccu?m?e?JC,-,"=?                """=='?"ComTraveller - small tool to parse and extract information about all registered CLSIDs on the systemUsage:--file <output> - output filename. Default: output.csv--from <clsid> - start exploring clsids from this clsid. (for ex. default enum from 1 to 9. with --from 4 will be from 4 to 9)--session <session> - use if you want to check Cross-Session Activation in a specific session. Useful only with 'Run as interactive user COM objects'--target <CLSID> - analyze this CLSID-h/--help - shows this screen

.ComTraveller.exe --file rep.csv --session 1