AI
Turning Domain Controllers into Attack Bots
The LDUP nightmare vulnerability crashed domain controllers without authentication by feeding an invalid referral value to the LDUP client in the critical LSASS process. The researchers realized they could turn domain controllers into LDUP clients via an unauthenticated RPC call (DSR GetDCNameEx2). Instead of crashing them, they returned a valid referral list pointing to a victim server. The client chased each referral, sending an LDUP query to the victim IP. Since web servers reject LDUP packets, each connection closes and the client moves to the next referral, flooding the target.
Stateless RPC: Skipping the Handshake
Shahak discovered that Windows RPC accepts a bind and call in a single TCP packet without waiting for the bind acknowledgement. This stateless RPC technique eliminates the round-trip delay per call. The attack sends the bind and call together, then immediately sends the next packet without waiting for replies. This increased their call-per-second rate dramatically. They applied it to the Netlogon interface in LSASS, which has an unauthenticated RPC call that allocates at least 256 KB per call. With 30,000 packets, memory exhausts and the domain controller crashes.
Torpedo: A Single-Machine DoS Attack
To overcome the bottleneck of sequential bind and call, the researchers split the attack into two phases. First, send thousands of bind packets to open connections. Windows RPC servers keep these idle bindings for at least 10 minutes. Then, flood the server with RPC calls simultaneously. This bypasses the per-call overhead and spikes memory allocation in a short window. They tested on the Netlogon RPC call that inserts challenges without size validation. With torpedo, they sent many more calls within the 2-minute cleanup window, crashing LSASS and rebooting the machine.
Four Vulnerabilities: From Domain Controllers to Windows 11
The research yielded four new remote unauthenticated denial-of-service vulnerabilities. The first Win-DoS attack uses LDUP referral overflow to turn domain controllers into bots for DDoS. The second uses the Netlogon RPC call with a large entry count parameter. The third applies torpedo to the Netlogon challenge insertion to crash domain controllers. The fourth uses an authenticated RPC in Spooler with pre-signed packets to crash any Windows endpoint. A single domain user can crash all machines in the domain. All vulnerabilities were patched by Microsoft.
Notable Quotes
This vulnerability allowed to crash any domain controller without any need for authentication or user interaction. Or Yair · ▶ 3:47
What if instead of returning an invalid value in the Elder preferral response, we’ll return a completely valid one with referrals that point towards a DOS victim. Or Yair · ▶ 10:34
We believe that if Windows if winds would not have been fixed such an attack would have dramatically lowered the bar for attackers to conduct a DOS attack. Or Yair · ▶ 17:09
Now a single user can crush all Windows machine in a domain. Or Yair · ▶ 31:41
Key Takeaways
- Remote code must handle worst-case concurrency and resource exhaustion.
- Assume all infrastructure can be targeted, even non-public-facing systems.
- Attackers can turn servers into clients to harness resources or frame others.
About the Speaker(s)
Or Yair (@oryair1999) is a security research professional with seven years of experience, currently serving as the Security Research Team Lead at SafeBreach. His primary focus lies in vulnerabilities in the Windows operating system’s components. He frequently presents at Black Hat, DEF CON, RSAC, SecTor, and more.
Shahak Morag currently serves as the Research Lead at SafeBreach, with over seven years of experience in security research. His background includes extensive expertise in Linux kernel and embedded systems, with more than one year of focused research on Windows platforms.