Abusing WCF Endpoint for RCE and Privilege Escalation
summary
WCF endpoints in .NET apps expose powerful operations that lead to real RCE and local privilege escalation: static analysis with dnSpy and Process/sys queries finds service contracts, local named‑pipe endpoints and net.tcp listeners (example net.tcp://localhost:81 and a remote net.tcp:8000). A WCF client is built from shipped DLL stubs in Visual Studio; authentication is bypassed by installing a self-signed cert into the Windows store so signed checks pass, then invoking ExecuteInstaller to run an arbitrary EXE as SYSTEM (demo spawns calc and creates a local admin). Tools: Process Explorer, WMI one‑liner, PowerShell.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 1:04WCF overview and exploitation basics
- 4:59Target enumeration techniques
- 8:08Analyzing vulnerable WCF service
- 13:08Real-world privilege escalation bugs
- 21:24Exploiting Check Point ZoneAlarm
- 23:44Remote WCF endpoint vulnerability
- 27:15Conclusion and takeaways
- 27:57Q&A session
related talks
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
39mWindows Agentless C2: (Ab)using the MDM Client Stack
58mPrivilege Escalation in Microsoft Azure
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
42mThe Rise of Potatoes: Privilege Escalations in Windows Services
01h 06mComputrace Backdoor Revisited
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
44mwhoami priv - show me your privileges and I will lead you to SYSTEM