To little surprise it seems that multiple #antivirus vendors have been ignoring COM hijacking as a self-defense bypass and LPE vector since at least 2018, when I first published about this technique (see my prev post).

At #38c3 guys from Neodyme demonstrated some more elegant exploits than my initial PoCs, nice work! My German is rusty but I think I'd have some comments about proposed solutions :)

ReLive will be available here:

https://streaming.media.ccc.de/38c3/relive/815