Abstract

This presentation explores the details of MSRPC interfaces, focusing on the no authentication landscape thorough security research approach. The session starts by explaining the basics of Remote Procedure Call (RPC). Then, the research will discuss the link between famous null session and MS-RPC interfaces. As the result of this research will be new path for enumerating domain information including domain users.

In the research I will take you on a journey through my security research methodology against MS-RPC interfaces, which I developed after observing some interesting behavior from one of the Windows interfaces. As a result of this research, I will show how we can link this behavior to null sessions. Putting it all together, I will demonstrate how we can revive the legacy of null sessions by enumerating information from the domain controller and, most importantly, enumerating domain users without triggering any alerts and without being stopped by defenders.

A new Python tool will be introduced, implementing this innovative enumeration path alongside a corresponding Metasploit module.
The research will analyze why this type of enumeration cannot be effectively halted, providing examples related to some Windows services. The research will also show how the native Windows audit policy fails to effectively monitor such enumerations, and explore alternative methods that can be used.

This presentation is designed for security researchers, penetration testers and blue teamers eager to deepen their understanding of MSRPC interfaces and enhance their research techniques.