## Description
COM-Hunter is a COM Hijacking persistence tool.
Available in both a .NET version and a BOF variant fully compatible with Cobalt Strike.
The following list explains the available modes:
- **Search Mode**: Searches for CLSIDs based on `LocalServer32`, `InprocServer32`, and registry entries under both `HKLM` and `HKCU`.
- **Classic Persist Mode**: Performs classic COM hijacking persistence using `LocalServer32` or `InprocServer32`.
- **Task Scheduler Mode**: Automatically establishes COM hijacking persistence via Task Scheduler using `LocalServer32` or `InprocServer32`.
- **TreatAs Mode**: Performs COM hijacking persistence via the TreatAs registry key and a fake (forwardable) CLSID using `LocalServer32` or `InprocServer32`.
- **Remove Mode**: Removes persistence mechanisms that rely on `LocalServer32`, `InprocServer32`, and related registry entries under both `HKLM` and `HKCU`.
## Disclaimer
## Table of Contents
- [COM-Hunter](#com-hunter)
- [Description](#description)
- [Disclaimer](#disclaimer)
- [Table of Contents](#table-of-contents)
- [Acknowledgement](#acknowledgement)
- [Usage](#usage)
- [.NET Examples](#net-examples)
- [BOF Implementation](#bof-implementation)
- [References](#references)
## Acknowledgement
This project created with :heart: by [@nickvourd](https://x.com/nickvourd) && [@S1ckB0y1337](https://x.com/S1ckB0y1337).
Special thanks to my friend [Marios Gyftos](https://www.linkedin.com/in/marios-gyftos-a6b62122/) for his invaluable assistance during the beta testing phase of this tool.
Inspired by the [RTO course](https://www.zeropointsecurity.co.uk/course/red-team-ops) from [@zeropointsecltd](https://x.com/zeropointsecltd).
BOF implementation inspired by [Lefteris Panos](https://x.com/lefterispan) and his awesome project, [RegPersist](https://github.com/leftp/RegPersist).
The `base.c` and `bofdefs.h` files are direct copies from [TrustedSec's CS-Situational-Awareness-BOF](https://github.com/trustedsec/CS-Situational-Awareness-BOF) project.
## Usage
██████╗ ██████╗ ███╗ ███╗ ██╗ ██╗██╗ ██╗███╗ ██╗████████╗███████╗██████╗
██╔════╝██╔═══██╗████╗ ████║ ██║ ██║██║ ██║████╗ ██║╚══██╔══╝██╔════╝██╔══██╗
██║ ██║ ██║██╔████╔██║█████╗███████║██║ ██║██╔██╗ ██║ ██║ █████╗ ██████╔╝
██║ ██║ ██║██║╚██╔╝██║╚════╝██╔══██║██║ ██║██║╚██╗██║ ██║ ██╔══╝ ██╔══██╗
╚██████╗╚██████╔╝██║ ╚═╝ ██║ ██║ ██║╚██████╔╝██║ ╚████║ ██║ ███████╗██║ ██║
╚═════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚═╝ ╚═╝
Version: 3.0
@nickvourd && @S1ckB0y1337
~ Inspired during the RTO course by @zeropointsecltd ~
Usage: COM_Hunter.exe
[+] Available Modes:
search Search Mode
persist Classic Persist Mode
tasksch Task Scheduler Mode
treatas TreatAs Mode
remove Remove Mode
[+] Search Mode:
Usage: COM-Hunter.exe search
-a, --all Search DLL and EXE implementations in HKLM and HKCU
-i, --inprocserver32 Search DLL implementations in HKLM and HKCU
-l, --localserver32 Search EXE implementations in HKLM and HKCU
-m, --machine Search DLL and EXE implementations in HKLM
-u, --user Search DLL and EXE implementations in HKCU
[+] Classic Persist Mode:
Usage: COM-Hunter.exe persist
