Bypassing AMSI via COM Server Hijacking

Discussion in 'other security issues & news' started by itman, Aug 3, 2017.

  1. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    https://posts.specterops.io/bypassing-amsi-via-com-server-hijacking-b8a3354d1aff
     
  2. guest

    guest Guest

    hehe; the eternal race between blackhats/pentesters and security developers :D
     
  3. gorblimey

    gorblimey Registered Member

    Joined:
    Jan 19, 2017
    Posts:
    158
    Location:
    West Oz
    Ummmm... No. I forget the origin of the quote, too lazy to look it up: "Against stupidity the gods themselves contend in vain."

    My coding is late last century. But even I know that strengthening one routine requires much more than just local variables. If the patched dll lives in the same global context as the original, it is just as weak as the original. M$ simply put a cover over the hole, and even forgot to paint it!

    The only race I see here is to the bottom.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.