auditing-windows-named-pipe-and-rpc-exposure

Auditing Windows named pipe and RPC exposure: when a local endpoint hands out privilege

A privileged Windows service often exposes an interface for others to talk to it: a named pipe, a remote procedure call endpoint, or a local COM server. Those interfaces are safe only when the service restricts who may connect and checks what each caller is authorized to ask for, and only when it does not blindly assume the identity of whoever connects. The exposure is an interface reachable by a lower-privileged caller that then performs a privileged action on the caller's behalf, or impersonates the connecting client in a way that lets a crafted caller flip the trust, or trusts caller-supplied input, a path, a command, a target, without checking the caller's authorization. In each case a standard user drives the privileged service into doing something the user could not do directly. The bug is a privileged action reachable across an inter-process boundary without the authorization that boundary should enforce. You audit these by listing each service's interfaces, who can reach them, and what each exposed operation does with the caller's request.

When to use

• A privileged service exposes a named pipe, RPC endpoint, or local COM server reachable by non-administrators.
• An exposed operation performs a privileged action or acts on caller-supplied input.
• A service impersonates connecting clients and a crafted caller may exploit that impersonation.

Scope check

Audit inter-process interfaces only on hosts you own or are authorized to assess, on non-production or a snapshot, using a benign proof that the privileged action was driven rather than performing a damaging one. A confirmed exposure lets a standard user drive privileged behavior, so keep every probe within scope. If you can't name the authorization, stop.

The loop

1. Establish whether the interface restricts callers and authorizes each operation first. For each exposed interface, determine whether its permissions limit who may connect and whether the service checks the caller's authorization for each operation, or whether a lower-privileged caller can both reach it and invoke a privileged action. This is the false-positive killer: an interface restricted to administrators, or one that authorizes each operation against the caller, is not driven by a standard user however powerful its actions. Name the reachable operation and the missing check before crafting a call.