ITSEC Newsletter 2025-05-22

The “vulnerability by design of the COM object” model and PowerShell’s type system and different languages program, affecting any COM object method that accepts string parameters. When these methods receive a custom object instead of an expected string, PowerShell’s automatic type coercion mechanism invokes the object’s ToString() method, potentially executing arbitrary code through a controlled string return value.

When it comes to targeting enterprise deployment infrastructure during a Red Team engagement, SCCM (System Center Configuration Manager) tends to get all the love. There’s a lot of research, tradecraft and blog post write-ups covering SCCM misconfigurations, credential exposure, and lateral movement opportunities. But while SCCM gets the spotlight, it’s often-overlooked half-cousin, Microsoft Deployment Toolkit (MDT), quietly presents a few of the same opportunities, sometimes with even less effort required. And yet, MDT is frequently left out of the conversation. Let’s fix that.