You Snooze You Lose: RPC Racer Winning RPC Endpoints Against Services
Introduces RPC Racer, a technique that exploits race conditions in Windows RPC endpoint registration to hijack privileged system service communication.
Summary
Windows Remote Procedure Call Architecture
Windows relies on Remote Procedure Call (RPC) interfaces for inter-process communication between user applications and privileged background services (such as LSASS, Spooler, and DCOM).
Race Conditions in RPC Endpoint Binding
Ron Ben Yizhak identifies a widespread timing flaw in how Windows system services register and bind dynamic RPC endpoints during system boot and service restarts.
RPC Racer: Hijacking Privileged Service Endpoints
The author introduces RPC Racer, an exploit technique that wins registration race conditions against legitimate services, allowing an unprivileged attacker to bind to intended service interfaces and intercept or manipulate privileged IPC messages.
Remediation and Defensive Guidance
Securing Windows RPC interfaces requires developers and Microsoft to enforce exclusive interface binding flags, mandate interface security callbacks, and audit endpoint registration timing.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·43 min
A Hernando · B Martinez
Uncovers overlooked legacy Windows execution paths and registry mechanisms to establish stealthy persistence that evades modern EDR detection.