Abstract

One of the big targets for Windows security vulnerabilities in recent years has been insecure RPC services. It's also one of the harder areas to explore due a lack of good security tooling. For this reason I wrote .NET based tooling to extract and call arbitrary local RPC services on Windows which could be used for analysis testing and fuzzing.

However, local vulnerabilities are not the only important attack surface. RPC can be used remotely over various network protocols, resulting in some interesting security vulnerabilities such as Zerologon and PetitPotam. Therefore I spent time in the past year improving the tooling to provide a wider range of protocols and features.

This presentation will describe the changes I've been making to my tooling to support new RPC protocol sequences such as TCP, SMB and Hyper-V sockets. It also has gained cross platform RPC support including NTLM and Kerberos authentication on Linux or macOS with .NET core. I'll also discuss some of the issues that I've discovered and interesting attack surfaces to look into. All the new tooling will be released prior to the conference so attendees can immediately start using them.