Win-DoS Epidemic: Abusing RPC for Win-DoS & Win-DDoS
Discloses new remote denial-of-service vulnerabilities in Windows RPC and Active Directory that enable cascading Win-DoS and Win-DDoS epidemics across Domain Controllers.
Summary
The Criticality of Domain Controllers in Enterprise Security
Active Directory Domain Controllers (DCs) serve as the core identity and authentication backbone for enterprise networks. Taking down DCs paralyzes organizational operations.
Discovering New RPC Denial-of-Service Vulnerabilities
Building upon their LDAPNightmare research (CVE-2024-49113), Or Yair and Shahak Morag identify multiple novel denial-of-service vulnerabilities in Windows Remote Procedure Call (RPC) and Active Directory services.
Creating the Win-DoS and Win-DDoS Epidemic
Attackers can trigger memory corruption and infinite processing loops on target DCs, inducing them to forward malformed RPC requests to secondary DCs and forming a self-propagating denial-of-service wave.
Hardening Windows RPC and Domain Controller Defenses
Mitigating RPC-based DoS epidemics requires applying Microsoft security updates, restricting RPC endpoint binding, and isolating Domain Controller interfaces behind internal firewalls.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·36 min
Ron Ben Yizhak
Introduces RPC Racer, a technique that exploits race conditions in Windows RPC endpoint registration to hijack privileged system service communication.