Searching for RPC Functions to Coerce Authentications in Microsoft Protocols
summary
Automates parsing Microsoft OpenSpecs and IDL to extract RPC interfaces, operation numbers and parameter names, translates IDL types into Impacket structures and generates Python PoC with Impacket via Jinja2 templates, then runs those PoCs to trigger authentications; the pipeline rediscovers PrinterBug, PetitPotam, ShadowCoerce and DFSCoerce in minutes and ships a repo of per-call PoCs. Includes a tool called coercer with scan / coerce / fuzz modes for scanning machines, provoking and mass-testing RPC calls. Works but needs target services enabled and manual type-mapping; defenses: disable unused services, enable Extended Protection for Authentication, and block outbound SMB.
AI-written summary · about
chapters (13)
- 0:00Intro
- 2:12Required information to call a Remote Procedure
- 2:51Remote Procedures manipulating files
- 6:54Automated search of RPCs triggering authentications
- 8:32Parsing Microsoft Open Specifications documentation
- 9:03Microsoft Open Specifications structure
- 10:30Parsing Interface Definition Language (IDL)
- 12:50Searching for interesting RPC functions
- 15:07Autogenerating proof of concept python scripts
- 19:44IDL types vs Impacket types
- 21:26Windows coerced authentications methods
- 24:04Coercer: mode scan
- 26:13Defense techniques
related talks
35mLifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
44mFor the Greater Good: Leveraging VMware's RPC Interface for fun and profit
49mPowerShell for Security Incident Response
51mSecure and Compliant APIs - By Design
50mNetwork Defender Archeology: An NSM Case Study in Lateral Movement with DCOM
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10