irsl/cve-2020-1313

Proof of concept exploit of Windows Update Orchestrator Service Elevation of Privilege Vulnerability

cve-2020-1313's Issues

Not an Issue, but Background on why OleView.NET Failed

Nice bug,

The reason OleView.NET fails is the CLSID is registered with both InProcServer and LocalServer entries.

PS> $c = Get-ComClass -Clsid '9C695035-48D2-4229-8B73-4C70E756E519'
PS> $c.Servers
Key Value
--- -----
InProcServer32 C:\WINDOWS\System32\usosvc.dll
LocalServer32 <APPID HOSTED>

When enumerating interfaces I use CLSCTX_SERVER which combines all server types, the COM runtime sees the InProc registration and uses that, which doesn't support the CLSID and so fails. I might look at a way around that as there are probably other similar cases. You can enumerate using PowerShell though by creating the object manually and using the Get-ComInterface command on the new object. e.g.

PS> $o = New-ComObject -Class $c -ClassContext LOCAL_SERVER
PS> Get-ComInterface -Object $o
Name                 IID                                  HasProxy   HasTypeLib
----                 ---                                  --------   ----------
IUnknown             00000000-0000-0000-c000-000000000046 False      False
IMarshal             00000003-0000-0000-c000-000000000046 False      False
IUniversalOrchest... 33a57561-f713-4d31-b401-9ef72a564133 True       False
IUniversalOrchest... 598915fe-e7db-4abc-8cb7-d5498c6f71e4 True       False
IUniversalOrchest... c53f3549-0dbf-429a-8297-c812ba00742d True       False

Hope that's useful.