Aug 10, 2025Ravie LakshmananVulnerability / Endpoint Safety
Cybersecurity researchers have introduced new findings associated to a now-patched safety challenge in Microsoft’s Home windows Distant Process Name (RPC) communication protocol that may very well be abused by an attacker to conduct spoofing assaults and impersonate a recognized server.
The vulnerability, tracked as CVE-2025-49760 (CVSS rating: 3.5), has been described by the tech big as a Home windows Storage spoofing bug. It was mounted in July 2025 as a part of its month-to-month Patch Tuesday replace. Particulars of the safety defect had been shared by SafeBreach researcher Ron Ben Yizhak on the DEF CON 33 safety convention this week.
“Exterior management of file title or path in Home windows Storage permits a certified attacker to carry out spoofing over a community,” the corporate stated in an advisory launched final month.
The Home windows RPC protocol makes use of universally distinctive identifiers (UUIDs) and an Endpoint Mapper (EPM) to allow the usage of dynamic endpoints in client-server communications, and join an RPC shopper to an endpoint registered by a server.
The vulnerability basically makes it potential to control a core part of the RPC protocol and stage what’s known as an EPM poisoning assault that enables unprivileged customers to pose as a reliable, built-in service with the purpose of coercing a protected course of to authenticate in opposition to an arbitrary server of an attacker’s selecting.
Provided that the functioning of EPM is analogous to that of the Area Identify System (DNS) – it maps an interface UUID to an endpoint, simply the DNS resolves a website to an IP deal with – the assault performs out like DNS poisoning, wherein a risk actor tampers with DNS knowledge to redirect customers to malicious web sites –
Poison the EPM
Masquerade as a reliable RPC Server
Manipulate RPC purchasers
Obtain native/area privilege escalation by way of an ESC8 assault
“I used to be shocked to find that nothing stopped me from registering recognized, built-in interfaces that belong to core providers,” Ben Yizhak stated in a report shared with The Hacker Information. “I anticipated, for instance, if Home windows Defender had a novel identifier, no different course of would have the ability to register it. However that was not the case.”
“Once I tried registering an interface of a service that was turned off, its shopper linked to me as an alternative. This discovering was unbelievable—there have been no safety checks accomplished by the EPM. It linked purchasers to an unknown course of that wasn’t even operating with admin privileges.”
The crux of the assault hinges on discovering interfaces that are not mapped to an endpoint, in addition to those who may very well be registered proper after the system boots by benefiting from the truth that many providers are set to “delayed begin” for efficiency causes, and make the boot course of quicker.
In different phrases, any service with a guide startup is a safety threat, because the RPC interface would not be registered on boot, successfully making it prone to a hijack by permitting an attacker to register an interface earlier than the unique service does.
SafeBreach has additionally launched a device known as RPC-Racer that can be utilized to flag insecure RPC providers (e.g., the Storage Service or StorSvc.dll) and manipulate a Protected Course of Mild (PPL) course of (e.g., the Supply Optimization service or DoSvc.dll) to authenticate the machine account in opposition to any server chosen by the attacker.
The PPL know-how ensures that the working system solely masses trusted providers and processes, and safeguards operating processes from termination or an infection by malicious code. It was launched by Microsoft with the discharge of Home windows 8.1.
At a excessive degree, all the assault sequence is as follows –
Create a scheduled process that can be executed when the present consumer logs in.
Register the interface of the Storage Service
Set off the Supply Optimization service to ship an RPC request to the Storage Service, leading to it connecting to the attacker’s dynamic endpoint
Name the tactic GetStorageDeviceInfo(), which causes the Supply Optimization service to obtain an SMB share to a rogue server arrange by the attacker
The Supply Optimization service authenticates with the malicious SMB server with the machine account credentials, leaking the NTLM hash
Stage an ESC8 assault to relay the coerced NTLM hashes to the web-based certificates enrollment providers (AD CS) and obtain privilege escalation
To perform this, an offensive open-source device like Certipy can be utilized to request a Kerberos Ticket-Granting Ticket (TGT) utilizing the certificates generated by passing the NTLM data to the AD CS server, after which leverage it to dump all secrets and techniques from the area controller.
SafeBreach stated the EPM poisoning method may very well be additional expanded to conduct adversary-in-the-middle (AitM) and denial-of-service (DoS) assaults by forwarding the requests to the unique service or registering many interfaces and denying the requests, respectively. The cybersecurity firm additionally identified that there may very well be different purchasers and interfaces which are probably susceptible to EPM poisoning.
To higher detect these sorts of assaults, safety merchandise can monitor calls to RpcEpRegister and use Occasion Tracing for Home windows (ETW), a safety characteristic that logs occasions which are raised by user-mode purposes and kernel-mode drivers.
“Similar to SSL pinning verifies that the certificates will not be solely legitimate however makes use of a selected public key, the identification of an RPC server must be checked,” Ben Yizhak stated.
“The present design of the endpoint mapper (EPM) would not carry out this verification. With out this verification, purchasers will settle for knowledge from unknown sources. Trusting this knowledge blindly permits an attacker to regulate the shopper’s actions and manipulate it to the attacker’s will.”
