Abstract

Microsoft's Message Queuing (MSMQ) is a protocol that enables applications running at different times to communicate across heterogeneous networks and systems that may be temporarily offline. In April this year, the QUEUEJUMPER bug aroused public attension about the remote attack surfaces in MSMQ.

Over the last few months, we have conducted a research on MSMQ and have found 30+ vulneraiblities including RCE and EoP in it, in both user mode service and the kernel driver.

In this session, we'll explore the attack surfaces of Microsoft MSMQ. These remote/local attack surfaces cross multiple protocols including TCP/HTTP/MultiCast and the local kernel driver. For each attack surface we'll introduce the detailed implementation of the related module, as well as some real bugs we found in it.

We'll also introduce how we can chain multiple bugs we found to achieve remote code execution + kernel level EoP in MSMQ.