# Perfusion | Exploit For The RpcEptMapper Registry Key Permissions Vulnerability (Windows 7 / 2088R2 / 8 / 2012) **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking\ **Created:** [February 23, 2021, 2:12pm UTC](https://onehack.st/t/perfusion-exploit-for-the-rpceptmapper-registry-key-permissions-vulnerability-windows-7-2088r2-8-2012/173478 "2021-02-23T14:12:20Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\ **Post date:** [February 23, 2021, 2:12pm UTC](https://onehack.st/t/perfusion-exploit-for-the-rpceptmapper-registry-key-permissions-vulnerability-windows-7-2088r2-8-2012/173478/1 "2021-02-23T14:12:20Z")
[![](https://github.com/itm4n/Perfusion/raw/master/demo.gif)](https://github.com/itm4n/Perfusion/blob/master/demo.gif) On **Windows 7** , **Windows Server 2008R2** , **Windows 8** , and **Windows Server 2012** , the registry key of the `RpcEptMapper` and `DnsCache` (7/2008R2 only) services is configured with weak permissions. Any local user can create a `Performance` subkey and then leverage the _ **Windows Performance Counters** _ to load an arbitrary DLL in the context of the WMI service as `NT AUTHORITYSYSTEM` (hence the tool’s name). This tool is intended to help security consultants during penetration tests. This software is provided as is, and I will probably not provide any support. Though, I tested it thoroughly on three different virtual machines so there should not be any significant issue. For more information: [https://itm4n.github.io/windows-registry-rpceptmapper-eop/](https://itm4n.github.io/windows-registry-rpceptmapper-eop/) **Known issues** **READ THIS BEFORE USING THIS TOOL** During the development phase of this tool, I observed **two different behaviors** : 1. The DLL is loaded **directly by the main process** of the WMI service as `NT AUTHORITYSYSTEM`, in this case the exploit works perfectly fine. 2. The DLL is loaded **by a subprocess** of the WMI service that runs as `NT AUTHORITYLOCAL SERVICE`. In this case, the service loads the DLL **while impersonating the client**. It turns out a privilege escalation is still possible on Windows 7 (because of another vulnerability) but the implementation cost was not worth the effort. I am not able to explain this difference because my _trigger_ code was always the same. Anyway, in either case, **let the exploit do its job** so that it can clean everything up when it’s done. If the exploit fails, there is still a chance it will work a few minutes or hours later though. Here is what you should see when the exploit works: ```auto C:Temp>Perfusion.exe -c cmd -i[*] Created Performance DLL: C:UsersLab-UserAppDataLocalTempperformance_2900_368_1.dll[*] Created Performance registry key.[*] Triggered Performance data collection.[+] Exploit completed. Got a SYSTEM token! :)[*] Waiting for the Trigger Thread to terminate... OK[*] Deleted Performance registry key.[*] Deleted Performance DLL.Microsoft Windows [Version 6.2.9200](c) 2012 Microsoft Corporation. All rights reserved.C:Temp>whoamint authoritysystemC:Temp> ``` Here is what you should see when the exploit fails: ```auto C:Temp>Perfusion.exe -c cmd -i[*] Created Performance DLL: C:UsersLab-UserAppDataLocalTempperformance_636_3000_1.dll[*] Created Performance registry key.[*] Triggered Performance data collection.[-] Exploit completed but no SYSTEM Token. :/[*] Waiting for the Trigger Thread to terminate... OK[*] Deleted Performance registry key.[*] Deleted Performance DLL.C:Temp> ``` **Build instructions** This solution is composed of two projects that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions: 1. Open the Solution with Visual Studio 2019 2. Select `Release / x64` 3. `Build > Build Solution` **Usage** You can check the help message using the `-h` option. ```auto C:TOOLS>Perfusion.exe -h ________ _| _ | ______ | _|_ _ ___|_|___ ___|__ | -_| _| _| | |_ -| | . | | version 0.1| __| |___ |_| |_| | ___|___ |_|___|_|_| by @itm4nDescription: Exploit tool for the RpcEptMapper registry key vulnerability.Options: -c Command - Execute the specified command line -i Interactive - Interact with the process (default: non-interactive) -d Desktop - Spawn a new process on your desktop (default: hidden) -h Help - That's me :) ``` **Remediation / Patch** The following versions of Windows are vulnerable: | Windows version | Vulnerable registry keys | | --- | --- | | Windows 7 | RpcEptMapper, DnsCache | | Windows Server 2008R2 | RpcEptMapper, DnsCache | | Windows 8 | RpcEptMapper | | Windows Server 2012 | RpcEptMapper | As far as I know, this vulnerability will not be fixed by Microsoft, for some reason. The best solution is still to upgrade to Windows 10 / Server 2019 but if it is not a short-term option, you can still patch this issue yourself by removing the `CreateSubKey` permission for both `NT AUTHORITYAuthenticated Users` and `BUILTINUsers` on the following registry keys: - `HKLMSYSTEMCurrentControlSetServicesRpcEptMapper` - `HKLMSYSTEMCurrentControlSetServicesDnsCache` I created a patch for this vulnerability in the form of a PowerShell script: [RegistryPatch.ps1](https://github.com/itm4n/Perfusion/blob/master/RegistryPatch.ps1). This script removes the `CreateSubKey` right on the two above-mentioned registry keys for the following identities: `NT AUTHORITYINTERACTIVE`, `BUILTINUsers` and/or `BUILTINAuthenticated Users`. - **Check if a machine is vulnerable:** (Windows Server 2012 here) ```auto PS C:Temp> . .RegistryPatch.ps1; Invoke-RegistryPatch -VerboseVERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesRpcEptMapperVERBOSE: Found a vulnerable ACE: "NT AUTHORITYAuthenticated Users" has "QueryValues, CreateSubKey, ReadPermissions" rightsVERBOSE: InheritanceFlags: NoneVERBOSE: IsInherited: FalseVERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesRpcEptMapperVERBOSE: Found a vulnerable ACE: "BUILTINUsers" has "QueryValues, CreateSubKey, Notify" rightsVERBOSE: InheritanceFlags: NoneVERBOSE: IsInherited: FalseTrue ``` - **Apply the patch:** (Windows Server 2008 R2 here) ```auto PS C:Temp> . .RegistryPatch.ps1; Invoke-RegistryPatch -Patch -Verbose VERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesRpcEptMapperVERBOSE: Found a vulnerable ACE: "NT AUTHORITYAuthenticated Users" has "QueryValues, CreateSubKey, ReadPermissions" rightsVERBOSE: InheritanceFlags: NoneVERBOSE: IsInherited: FalseVERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesRpcEptMapperVERBOSE: Found a vulnerable ACE: "BUILTINUsers" has "QueryValues, CreateSubKey, Notify" rightsVERBOSE: InheritanceFlags: NoneVERBOSE: IsInherited: FalseVERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesRpcEptMapperVERBOSE: The new ACL was appliedVERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesDnsCacheVERBOSE: Found a vulnerable ACE: "NT AUTHORITYINTERACTIVE" has "QueryValues, CreateSubKey, EnumerateSubKeys, ReadPermissions" rightsVERBOSE: InheritanceFlags: NoneVERBOSE: IsInhe rited: FalseVERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesDnsCacheVERBOSE: Found a vulnerable ACE: "BUILTINUsers" has "CreateSubKey, ReadKey" rightsVERBOSE: InheritanceFlags: NoneVERBOSE: IsInherited: FalseVERBOSE: Registry key: HKLMSYSTEMCurrentControlSetServicesDnsCacheVERBOSE: The new ACL was appliedTrue ``` **How does this exploit work?** Below are the exploit steps that are implemented in this tool: 1. A Process is created in the background in a suspended state (using the specified command line). 2. The embedded payload DLL is written to the current user’s `Temp` folder. 3. A `Performance` key is created under `HKLMSYSTEMCurrentControlSetServicesRpcEptMapper` and is populated with the appropriate values, including the full path of the DLL that was created at step 2. 4. The WMI class `Win32_Perf` is created and invoked to trigger the collection of _Windows Performance Counters_. 5. The DLL is loaded by the WMI service either as `NT AUTHORITYSYSTEM` or `NT AUTHORITYLOCAL SERVICE`. 6. If the DLL is loaded by `NT AUTHORITYSYSTEM`, its Token is duplicated and is applied to the Process that was initially created by the user at step 1. 7. Everything is cleaned up and the main Thread of the suspended Process is resumed. ## GitHub: [https://github.com/itm4n/Perfusion](https://github.com/itm4n/Perfusion)