Exploring Ancient Ruins to Find Modern Bugs: Auditing MS-RPC
Akamai researchers Ben Barnea and Ophir Harpaz explore Microsoft Remote Procedure Call (MS-RPC), discovering zero-day vulnerabilities in core Windows services.
Summary
The Ubiquitous and Complex World of MS-RPC
Microsoft Remote Procedure Call (MS-RPC) serves as the backbone communication protocol for nearly all internal Windows services, Domain Controllers, and enterprise servers.
Deconstructing RPC Interfaces, IDL, and NDR Engines
Ben Barnea and Ophir Harpaz dissect Network Data Representation (NDR) parsers and the complex type encoding mechanisms used across system services.
Discovering Zero-Days in Legacy RPC Handlers
The researchers demonstrate automated fuzzing and static analysis of undocumented RPC interfaces, uncovering critical memory corruption and privilege escalation bugs.
Hunting and Defending Against RPC-Based Exploitation
The authors release open-source RPC auditing tooling and provide detection engineers with RPC filter rules and telemetry hunting strategies.
Related talks
Main Stage·37 min
Or Yair · Shahak Morag
Discloses new remote denial-of-service vulnerabilities in Windows RPC and Active Directory that enable cascading Win-DoS and Win-DDoS epidemics across Domain Controllers.
Main Stage·42 min
Tomer Bar · Eran Segal
SafeBreach researchers analyze five years of Windows CVE patterns to predict recurring vulnerability classes and discover new zero-day local privilege escalations.
Main Stage·53 min
Halvar Flake
Halvar Flake details halvar Flake: RE 2006: New Challenges Need Changing Tools Abstract: Reverse Engineering has come a long way.