RPC Toolkit is a set of tools, articles, blog posts and links to help security researchers drive their RPC research.

During the last months, our team has put a lot of effort in learning MS-RPC, its internals, security and weaknesses. Along the way, we wrote some tools and automations to facilitate parts of the research process. We have shared our findings in blog posts, tweets and conference talks, and we'd like to make all these materials accessible through this repo.

We will also link to external tools and publications by other researchers, which we found useful in our learning process.

For a writeup about the toolkit and its latest changes, please refer to this blogpost: Fantastic RPC Interfaces and How to Find Them.

• IDL scraper and parser
• PE RPC scraper and parser
• Rpc Visibility
• RPCView (by Jean-Marie Borello, Julien Boutet, Jeremy Bouetard and Yoanne Girardin)
• RPCEnum (by @xpn)

• MS-RPC Security Measures - Flowchart
  • Original Whimsical
• An Overview of MS-RPC and Its Security Mechanisms
• Give Me an E, Give Me a T, Give Me a W. What Do You Get? RPC!
• RPC Interface Inventory
• RPC ProtocolSequence int to string
• A Definitive Guide to the Remote Procedure Call (RPC) Filter
• Analyzing RPC With Ghidra and Neo4j (by @xpn)
• Offensive Windows IPC Internals 2: RPC (by @csandker)

• CVE-2022-30216 - Authentication coercion of the Windows “Server” service
• Critical Remote Code Execution Vulnerabilities in Windows RPC Runtime
• RPC Runtime, Take Two: Discovering a New Vulnerability
• Cold Hard Cache: Caching Vulnerabilities in the Server and Workstation Services
• You’ve Crossed the Line — Disturbing a Host’s Rest (LSM Vulnerabilities)
• Can't Wait to Shut You Down — Remote DoS Using Wininit.exe
• LSM Vulnerability - Elevation of Privilege
• Exploring Three Remote Code Execution Vulnerabilities in RPC Runtime

• CVE-2022-30216
• CVE-2022-38034
• CVE-2022-37973
• CVE-2022-37998
• CVE-2022-44707
• CVE-2023-21771

• DEF CON 30 (Ben Barnea, Ophir Harpaz)
  • Slides
  • Demo video
  • Talk recording
• Hexacon (Stiv Kupchik, Ophir Harpaz)
  • Slides
  • Demo video
  • Talk recording
• BlackHat USA 2023 (Stiv Kupchik)
  • Slides
  • Demo video

Copyright 2023 Akamai Technologies Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.