AI
The Endpoint Mapper Has No Identity Checks
The endpoint mapper (EPM) resolves interface UUIDs to endpoints. Two rules govern it. Entries are removed only when the registering process terminates. The EPM always returns the first registered endpoint for an interface. Ron realized this design mirrors DNS. EPM has no mechanism to verify a process owns the interface it registers. No identity check exists at the EPM level. The EPM runs inside RPCSS and is reachable over TCP, named pipes, and LPC.
EPM Poisoning Works Without Admin Privileges
Ron called RpcEpRegister to register an interface belonging to a built-in Windows service. It worked without admin privileges. No security checks blocked the registration. Clients still connected to the original service because it had registered first. When Ron targeted a stopped service, clients connected to his rogue server instead. A medium-integrity process can hijack any RPC server not launched at boot. Microsoft applies no verification at the EPM level.
RPC Recon Maps Delayed-Start Interfaces
Ron built RPC Recon to scan for vulnerable interfaces. It queries the EPM and scans process memory to list all registered interfaces early in boot. After a delay, it scans again to find interfaces registered late. The difference reveals interfaces a non-admin can register before the legitimate service starts. RPC Recon is designed to run as a scheduled task at user logon. It is open-source on GitHub.
Storage Service Hijack Forces Machine Account Authentication
Ron registered the storage service interface and waited. Windows Update connected first, then the delivery optimization service. Both run as highly privileged accounts. The delivery optimization service runs as Network Service with system-level integrity. Ron’s rogue server returned an SMB share pointing to an external machine. The delivery optimization service authenticated against that server using the machine account. Ron relayed the NTLM authentication to an ADCS web server for a certificate.
Full Attack Chain Targets Domain Controllers
The attack chain starts as a medium-integrity process. RPC Racer registers the storage interface and triggers the delivery optimization service. The service queries the EPM, gets Ron’s endpoint, and calls GetStorageDeviceInfo. Ron returns an SMB share to an external relay server. The service authenticates with the machine account. The relay forwards to ADCS for a certificate. Certipy requests a TGT using that certificate. Secretsdump dumps all domain hashes.
Microsoft Patched One Client, Others Stay Open
Microsoft patched the storage service client on July 8 by adding security quality of service to the binding handle. The client now verifies the server runs as Local System. Other interfaces remain vulnerable. Ron recommends monitoring RpcEpRegister calls via hooking or ETW. The Microsoft-Windows-RPC provider logs process IDs, interface UUIDs, and procedure numbers. These events can detect an unknown process receiving RPC connections on a known interface.
Notable Quotes
I was shocked to discover that nothing stopped me from registering builtin and non-interfaces that belong to core services Ron Ben Yizhak · ▶ 7:58
This security gap is just insane Ron Ben Yizhak · ▶ 17:54
Even the most protected services will connect to us Ron Ben Yizhak · ▶ 18:47
There are no verifications on who is registering an interface that will be used by crucial services of the operating system Ron Ben Yizhak · ▶ 34:42
Key Takeaways
- EPM poisoning lets any process register any RPC interface without identity verification.
- RPC Recon maps interfaces that can be hijacked before their services start.
- RPC Racer forces machine account authentication and relays it for domain compromise.
About the Speaker
Ron Ben Yizhak (@RonB_Y) is a security researcher at SafeBreach with 10 years of experience. He works in vulnerability research and has knowledge in forensic investigations, malware analysis and reverse engineering. Ron previously worked in the development of security products and spoke several times at DEFCON.