If I theoretically have a way for a non-admin Windows user to be able to load an arbitrary already-on-system COM object library (InprocServer32) into a process that has system integrity, that could be argued to be a security boundary bypass.
But in the essence of PoC||GTFO, does anybody have any ideas for how this might be useful to an attacker? i.e., is there an object that can be leveraged to lead to privileged code execution?
Will Dormann
npub1n3…rk88f
2026-07-17 22:18:50 UTC
Author Public Key
npub1n3aew4nfpzqwqmws43pydswj06vu97wch6upnchrz4ku8ckc60nqfrk88fSeen on
wss://relay.ditto.pubPublished at
2026-07-17 22:18:50 UTCEvent JSON
{
"id": "2e22ff8d3e906da5b3d3e6c86db9dec85a967b9db93f46bdf959c0169b2e88e2",
"pubkey": "9c7b9756690880e06dd0ac4246c1d27e99c2f9d8beb819e2e3156dc3e2d8d3e6",
"created_at": 1784326730,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/wdormann/statuses/116937636600526021",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "If I theoretically have a way for a non-admin Windows user to be able to load an arbitrary already-on-system COM object library (InprocServer32) into a process that has system integrity, that could be argued to be a security boundary bypass.\n\nBut in the essence of PoC||GTFO, does anybody have any ideas for how this might be useful to an attacker? i.e., is there an object that can be leveraged to lead to privileged code execution?",
"sig": "f2f65edffb58af26c9348ed81b55eda730f7fe51c7cef4b080531c4c3af096e4ba773b4a55758b91257249a6d43a3d23d66a0110e48940e680edcd0cd2e6422a"
}