One Day Sec

How does the provided PowerShell script automate the COM hijacking exploitation against Outlook?

The script first determines the system architecture (32‑ or 64‑bit) and the Office version (by checking the `MEDIA` folder under `C:\Program Files\Microsoft Office`). It then selects the correct registry path (`HKCU\Software\Classes\CLSID` or `Wow6432Node`) and adds the required registry entries for the two COM objects, automating the entire persistence setup without needing admin rights.
PowerShell scriptautomationOffice version detectionWow6432Noderegistry path

Browse all Q&A →