Windows Exploitation Techniques: Dangling COM Object Registrations

This blog post describes a Windows privilege-escalation vulnerability involving a dangling in-process COM registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}) that allows an unprivileged user to plant a DLL under a writable ProgramData path and use custom COM marshaling to have a SYSTEM-hosted COM server load that DLL. The author documents the vulnerability context (incomplete Microsoft fixes), a practical exploitation path using the Shell Create Object Handler scheduled task that runs as SYSTEM and permits custom marshaling, sample PoC code, and PowerShell scanning scripts to find other dangling COM registrations.