DCOMrade

DCOMrade is a Powershell script that is able to enumerate the possible vulnerable DCOM applications that might allow for lateral movement, code execution, data exfiltration, etc. The script is build to work with Powershell 2.0 but will work with all versions above as well. The script currently supports the following Windows operating systems (both x86 and x64):

• Microsoft Windows 7
• Microsoft Windows 10
• Microsoft Windows Server 2012 / 2012 R2
• Microsoft Windows Server 2016

How it works

The script was made based on the research done by Matt Nelson (@enigma0x3), especially the round 2 blog post that goes into finding DCOM applications that might be useful for pentesters and red teams.

First, a remote connection with the target system is made, this connection is used throughout the script for a multitude of operations. A Powershell command is executed on the target system that retrieves all the DCOM applications and their AppID’s. The AppID’s are used to loop through the Windows Registry and check for any AppID that does not have the LaunchPermission subkey set in their entry, these AppID’s are stored and used to retrieve their associated CLSID’s.

The script uses a specific blacklist with each OS, this is why there are different options for the target operating system. The blacklist skips CLSID entries that might hang the script because of DCOM applications that cannot be activated, this reduces the load on the target system and reduces the time for the script to complete.

With the CLSID, the DCOM application associated with it can be activated. The ‘Shortcut’ CLSID is used to count the amount of MemberTypes associated with it, this is done to check the default amount of MemberTypes. This number is used to check for the CLSID’s that hold anything different than this amount. The script does this with the CLSID of the ‘Shortcut’ (HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}) because this is a shared CLSID across the Microsoft Windows operating systems. The CLSID’s with a different amount of MemberTypes might hold a Method or Property that can be (ab)used, and will be added to an array.

The CLSID’s in the array are being checked on strings in the MemberTypes that might indicate a way to (ab)use it, this list of strings can be found in the VulnerableSubset file. Please note that this list is by no means a complete list to find every single vulnerable DCOM application, but this list being a dynamic part of the process should give the user of the script a way to look for specific strings that might indicate a functionality of a DCOM application that might be useful for their purpose.

The results of the script are outputted in an HTML report and should be usable for auditing a system as a preventive measure. For the offensive side, I created an Empire module which at the time of writing is awaiting approval to be added to the master branch. If you would like to add this to Empire yourself you can do so by adding the module located here.

For a full technical explanation of the idea, the script and possible detection methods you can read the research paper associated with this.

Download && Use