Enhancing Automatic Vulnerability Discovery for Windows RPC/COM in New Ways

No ratings

Presented at Black Hat Europe 2024 by

Fangming Gu

Zhiniang Peng

R4nger .

In recent years, Microsoft Remote Procedure Call (RPC) and Component Object Model (COM) have become significant focal points in security research due to their vast attack surfaces to LPE and RCE vulnerabilities. The research community has done extensive research in this field. However, prior research have predominantly relied on pre-existing vulnerability patterns, this usually requires a lot of time and effort in reverse engineering. Additionally, fuzzing RPC/COM interfaces typically demands customized corpus and fuzzers tailored to interface definitions for each individual interface, resulting in inefficiency and complexity.Addressing these challenges, we introduce XALPC, a comprehensive RPC/COM fuzzing tool designed to systematically and effectively fuzz RPC/COM requests across the entire system at ALPC level. In addition, XALPC can serve as a monitor to detect a critical information leakage vulnerability pattern, which occurs continuously within the system but has been overlooked for a long time. Based on XALPC, we identified over 10 vulnerabilities within Windows RPC/COM services. In this presentation, we will explore the underlying mechanisms of XALPC and demonstrate how it can be utilized for automated vulnerability discovery.