> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/chaining-windows-n-days.md).

# Chaining Windows N-Days

Building a Windows N-Day Exploit Chain for RasMan - Asritha Bodepudi (ToB)

CVE-2026-21525

where to find slides / recordings?

## Overview

1. crash rasman server: abuses Port Linked List structure to complete a null dereference and crash rasman service
   1. find a path that sets Port to a contradictory state
      1. early crash w/o cleanup of flink + blink
      2. HINT: There's more pathst that can walk the UserData linked list after a bad PortOpenEx()
   2. reach path as unpriv?
      1. are PortOpenEx() & GetUserData() exposed over RPC? Yes! via NTOM
      2. can we reach as unpriv user?
         1. Examine RpcServerRegisterAuthInfoW(...), sets flags that allow you to bypass endpoint ACLs (need to look into more)
   3. if so, drive w/ custom rpc client
      1. NTOM lets you build RPC clients (automates the boilerplate, can automate RPC client builder w/ a powershell configuration script)
   4. prove the DoS
2. Impersonating RasMan?
   1. SafeBreach CVE-2025-49760 (EPM Spoofing)
      1. win the race - register fake endpoint in the EPM before real service starts
         1. took advantage of a malicioius RPC Server (uses same UUID as other RPC Server) and set delays in startup times for the real service, EPM thinks it's talking to the real RPC server
         2. instead of delaying, we can crash rasman using hte aforementionted crash
      2. masquerade as the EPM and send back diff ports
         1. when the RPC client connects, you can manufacture values sent back, the server uses rasmans.dll library to faciliate connections
         2. leverage RasAuto to lure system RasMan client into connecting to our malicious rasman server
      3. What now? How to escalate privs?
         1. tried impersonation (see below)
         2. tried NTLM relay
         3. phonebook files
            1. specified in VPN configs wher eyou can specify a DLL to be loaded (not widely applicable but possible)

{% code title="Register custom RPC server" %}

```cpp
RpcServerRegisterIf2(...)
RpcServerUseProtoseqEp()
RpcServerListen()
```

{% endcode %}

{% hint style="info" %}
every RPC client sues rasman.dll library while servers use rasmans.dll
{% endhint %}

identifying code changes for a CVE, download binaries for unpatched and patched versions on winbindex and by looking at the 

## Future Work

* Client can provide no crednetials and just set SECURE\_ONLY flag to see if you can bypass auth w/o valid creds
* scan binaries for some missing lazy, default, or no security configs using NTOM or powershell scripts, potentially chainable w/ NTLM, impersonation, etc
* can you abuse any level of trust you gain by compromising / impersonating an RPC server/client to trigger diff codepaths

## Tools

* RasAuto (creates connection to a remote network whenever a rpogram references a DNS or NetBios name
* windbg
* binninja scripting
* bindiff
* winbindex
* rpcview: decompile rpc servers and view uuids and processes
* NTObjectManager (NTOM) for identifying available functions in an RPC interface

## Access Tokens

Security Reference Monitor (SRM) [Accounts && Groups In-Depth](/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth.md)

What are integrity levels in an Access Token? Take a look at the structure of an Access Token

* Primary Token vs Impersonation Token
* What's Impersonation Level
  * how far one can go during impersonation (identification (RO)

## RPC Crash Course

* RPC Runtime Library run by RPC Server

* RPCView <https://github.com/silverf0x/rpcview>

* An interface lists all available methods

* RPC Servers assigned string binding&#x20;
  * protocol\_Sequence:network\_address\[endpoint]
  * Protocol Sequence
    * NCACN (\~TCP)
    * NCADG (\~UDP)
    * NCALRPC
  * Network ddress
  * Endpoint
    * ncalrpc (ALPC port name)
    * ncacn\_np: named pipe name
    * ncacn\_ip\_tcp: (TCP port name)
    * e.g. (fill in)

* Two types of endpoints
  * well-known endpoints (hardcoded by client ex. "ncalrpc:RasmanLrpc"
  * dynamic endpoints: client queries RPC endpoint mapper

* Endpoint Mapper )(EPM)
  * uuid corresponding to thsi interface associated w/ this port, sits inbetween RPC client & server

* binding handle
  * prot seq, endopint, auth level, auth service, auth identity, QOS (impersonation level)
  * RPC client can set these binding handle values and RPC server can reject, but client can also deny&#x20;
  * if you're using (e.g. named pipes), you have to provide credentials but it won't do checks such as whether you're allowed to access a specific interface

*

*