Win-DoS Epidemic - Abusing RPC for Win-DoS & Win-DDoS

Win-DoS Epidemic: Abusing RPC for Win-DoS & Win-DDoS

Speakers: Or Yair, Shahak Morag

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=JLMsfH2MVCE

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Or%20Yair%20Shahak%20Morag%20-%20Win-DoS%20Epidemic%20A%20Crash%20Course%20in%20Abusing%20RPC%20for%20Win-DoS%20%26%20Win-DDoS.pdf

Overview

Or Yair and Shahak Morag from SafeBreach presented a comprehensive study of Denial of Service (DoS) vulnerabilities in Windows, centered on the abuse of Remote Procedure Call (RPC) interfaces. Their research grew from a single critical vulnerability — dubbed "LDAP Nightmare" — into a systematic methodology for discovering DoS and Distributed DoS (DDoS) conditions in Windows RPC services. The talk introduced novel techniques targeting developer blind spots in RPC implementation, yielding four new DoS vulnerabilities alongside the original. The research illustrates that while memory corruption and code execution bugs receive most security attention, DoS vulnerabilities against critical Windows services represent a serious and underexplored attack surface with significant operational impact.

Background

▶ Watch: Research motivation: developer blind spots in RPC service design (2:14)

Denial of Service as an attack class has historically been treated as less severe than remote code execution, but the threat landscape has shifted. According to CISA radar data cited by the speakers, there was a 56% increase in DoS attacks in recent years, and the speakers catalogued multiple high-profile incidents in 2024 alone: the CrowdStrike BSOD incident, attacks on UK retail infrastructure, an attack that disrupted 911 services, and ransomware-induced disruptions to healthcare. Each of these underscores that making systems unavailable can be as devastating operationally as compromising their confidentiality.

Windows as a DoS target is particularly consequential because of its prevalence in enterprise infrastructure. Domain controllers running Active Directory, file servers, certificate authorities, and other critical services almost universally run Windows. A vulnerability that allows an unauthenticated or low-privileged attacker to crash a domain controller — without any authentication — represents a significant operational risk.

The gateway into this research was the LDAP Nightmare vulnerability (CVE-2024-49113), which the team had previously discovered and which demonstrated that the LDAP service on Windows domain controllers could be crashed by a specially crafted packet. This became the seed for a broader question: how many other Windows RPC interfaces have similar crash conditions?

Key Findings

▶ Watch: Extended methodology: finding new RPC DoS interfaces systematically (7:42)

• Four new DoS vulnerabilities were discovered through the systematic methodology developed during this research, in addition to the original LDAP Nightmare.
• LDAP Nightmare (CVE-2024-49113) is a critical unauthenticated vulnerability that crashes the LDAP service on Windows domain controllers. A single packet sent to a domain controller can take it offline, with significant downstream effects on the entire Active Directory environment.
• Win-DDoS amplification is achievable by combining LDAP Nightmare with Windows' own built-in DsrGetDcNameEx2 API — a legitimate Windows function that causes a targeted server to perform LDAP lookups against an attacker-specified target, effectively making Windows amplify an attack on a third-party target.
• Developer blind spots in RPC implementation create systematic vulnerability patterns. The researchers identified specific coding patterns that appear repeatedly in RPC service implementations and that reliably lead to crash conditions when triggered with unexpected input.
• RPC is an enormous, underaudited attack surface. The researchers counted the sheer number of RPC interfaces exposed by a default Windows installation and noted that the vast majority have never been audited for DoS conditions.

Technical Deep Dive

▶ Watch: LDAP Nightmare (CVE-2024-49113): single packet crashes domain controller LDAP (15:50)

The LDAP Nightmare vulnerability exploits a flaw in how the Windows LDAP service handles a specific type of CLDAP (Connectionless LDAP) packet. The CLDAP protocol is used for domain controller discovery over UDP. When a specially crafted packet with a referral URL pointing to an attacker-controlled server is sent to the domain controller, the DC attempts to follow the referral, triggering a null dereference or similar memory condition that crashes the LDAP service (lsass.exe). Because LSASS hosts multiple critical services, the crash can take the entire domain controller offline or require a restart.

Extending to Win-DDoS: The DsrGetDcNameEx2 RPC call is a legitimate Windows API for locating domain controllers. When called with specific parameters, the target machine performs outbound LDAP queries. By pointing this at a victim system, an attacker with access to any Windows machine in an environment can instruct that machine to repeatedly pound a third-party LDAP endpoint with requests. The attacker's traffic is amplified: a small RPC call results in sustained LDAP traffic to the victim, and since the source of the traffic is the Windows machine rather than the attacker, attribution and blocking are complicated.

Systematic RPC vulnerability discovery methodology: The researchers developed a framework for identifying DoS-prone patterns in RPC server implementations. Key developer blind spots they identified include:

1. Insufficient input validation on string parameters — RPC methods that accept strings without validating their format or length, particularly those that are subsequently passed to networking functions, can be triggered into unexpected code paths by malformed input.
2. Referral chasing without bounds or timeouts — Services that automatically follow referrals or pointers embedded in protocol fields without limiting the depth or number of lookups.
3. Shared process crashes — Multiple Windows RPC services co-host in shared service processes. A crash in any service hosted in a shared SVCHOST instance brings down all co-hosted services simultaneously, amplifying impact.
4. Synchronous RPC handling without resource limits — Services that handle RPC calls synchronously and do not enforce per-client resource quotas can be exhausted by rapid repeated calls.

The researchers applied these patterns systematically across Windows RPC interfaces, using a combination of interface enumeration, fuzzing, and manual code review to identify candidates and validate crashes.

Demo / Proof of Concept

▶ Watch: Impact confirmed: unauthenticated attack affects thousands of DCs worldwide (28:52)

The talk included live demonstrations:

• A proof-of-concept for LDAP Nightmare was shown crashing an LDAP service on a domain controller in a test environment. The attack required no authentication — a single specially crafted UDP packet triggered a clean crash of the LDAP service.
• The Win-DDoS amplification technique was demonstrated by invoking DsrGetDcNameEx2 against a target, resulting in the Windows machine generating sustained outbound LDAP traffic to the attacker-specified victim. The speakers measured the amplification factor and showed that even a single Windows machine could generate meaningful traffic against a victim.
• A broader demo illustrated the cascading effects of taking down a domain controller: Kerberos authentication fails across the domain, Group Policy cannot be applied, DNS resolution for internal names degrades, and workstations can no longer authenticate users.

Public proof-of-concept code for LDAP Nightmare was released as part of the research disclosure.

Defensive Implications

▶ Watch: DDoS amplification: abusing DsrGetDcNameEx2 to turn Windows into attack ampli... (33:46)

Patching is the primary mitigation. All disclosed vulnerabilities were reported to Microsoft through responsible disclosure and patched. Ensuring systems are current with Windows patches is the most important defensive action.

Network segmentation for LDAP. CLDAP (UDP port 389) traffic should be restricted at the network perimeter. Domain controllers should not receive unsolicited CLDAP packets from untrusted networks. Where possible, restrict which hosts can initiate CLDAP and LDAP connections to domain controllers.

Monitor for LDAP service crashes. LSASS crashes on domain controllers should trigger immediate alerts. While crashes can have benign causes, they are uncommon in healthy environments and an LSASS crash warrants investigation. Windows Event IDs related to LSASS termination and domain controller replication failures are useful detection signals.

Audit RPC exposure. Organizations should audit which RPC interfaces their Windows servers expose, particularly from untrusted network segments. Tools like RPC Dump can enumerate exposed RPC interfaces and help identify services that should be firewalled.

Consider DDoS amplification risk. The Win-DDoS technique involves legitimate Windows behavior being abused for amplification. Organizations should be aware that their Windows infrastructure could be leveraged to attack third parties, and should monitor for unusual outbound LDAP traffic patterns.

Key Takeaways

1. DoS vulnerabilities against Windows RPC services represent a significant and underexamined attack surface, particularly for domain controllers where availability is critical.
2. LDAP Nightmare (CVE-2024-49113) allows unauthenticated crash of Windows LDAP services via a single UDP packet.
3. Windows built-in APIs can be abused for DDoS amplification, using the target's own Windows machines as attack reflectors.
4. Systematic methodology targeting developer blind spots in RPC implementation can yield multiple related vulnerabilities across the same codebase.
5. The impact of DoS vulnerabilities against Active Directory infrastructure extends far beyond the crashed service, cascading into authentication, DNS, policy, and certificate services.
6. Patch management and network-level restriction of LDAP/CLDAP access are the most effective defensive measures.

About the Speaker(s)

▶ Watch: Surprising finding: authenticated scenarios worsen the DDoS amplification impact (38:19)

Or Yair is the Security Research Team Lead at SafeBreach with over seven years of experience in security research. His background spans Linux, embedded systems, and Android, with a primary focus for the past four-plus years on vulnerability research in Windows and third-party Windows applications. This was his second DEF CON talk.

Shahak Morag is a Research Lead at SafeBreach with seven years of experience in security research. His background includes extensive expertise in kernel and embedded systems, with more than a year of focused research on Windows platforms.