Why do we need to modify the PEB structure when exploiting this COM component?

Modifying the Process Environment Block (PEB) to impersonate `explorer.exe` is necessary because the COM component only suppresses UAC dialogs when called from a process that the system trusts—specifically `explorer.exe` or processes that mimic it. By altering the PEB, the current process appears as `explorer.exe` to the Component Object Model (COM) runtime, allowing it to load a high-privilege COM component without triggering a UAC prompt. This technique is similar to that used in other UAC bypass methods, such as [Using CLR to Bypass UAC](/news/use-clr-to-bypass-uac).