Searching for RPC Functions to Coerce Authentications in Microsoft Protocols

No ratings

Presented at BlackHat Europe 2022 by

Remi Gascou

github.com

Although they have been used for several decades, Microsoft's Remote Procedure Calls have always lacked a serious security analysis. They always were the source of many security weaknesses, with coerced authentications, Local Privilege Escalations (LPE) and Remote Code Executions (RCE) vulnerabilities emerging from these functions. In this presentation, we'll go beyond the frontiers of existing research on coerced authentications leveraging Remote Procedure Calls, and detail a method to automatically find potentially vulnerable RPC calls from the Microsoft documentation. We'll see how these flaws allow us to fully compromise domains under certain conditions with a step-by-step demonstration of relaying a coerced HTTP authentication to Active Directory Certificate Services.Until today, most of the coerced authentication vulnerabilities found in MS RPC were found by researchers reading the openspecs documentation either online or in PDF and hoping to find an interesting new call. In this talk, we'll explore a way to automate this process by parsing Microsoft's OpenSpecs online documentation as well as Interface Definition Language code. After that, we'll use the gathered data to automatically find RPC calls potentially triggering authentications and generate python proof of concept code to trigger them remotely. Using this method, we find existing PrinterBug, PetitPotam, ShadowCoerce and DFSCoerce vulnerabilities in a matter of minutes.At the end of this talk, I'll release a few tools and resources to tinker with. The first is an open-source wiki containing all the RPC calls allowing you to coerce authentications with their python proof of concept code so you can try them out in your lab. The second is a set of tools to fuzz Microsoft RPC protocols remotely and the last is an opensource tool to automatically call every RPC function capable of coercing authentication from a Windows machine to an arbitrary target.