TLDR Tech / InfoSec
Recursively fuzzing MS-RPC structures and monitoring using ETW
Remco van der Meer enhanced his MS-RPC fuzzer with recursive structure handling via New-FuzzedInstance (depth-limited to 8 levels with visited-type tracking), union type support through random Arm_N field selection with proper discriminant setting, and replaced Process Monitor with native ETW monitoring of Microsoft-Windows-Kernel-File and Microsoft-Windows-Kernel-Registry providers to detect canary strings ("incendiumrocks_") in real-time syscalls. The fuzzer discovered RpcAddPrintProvidor [sic] in spoolsv.exe, which loads arbitrary DLLs as NT AUTHORITY\SYSTEM when provided a file path (appending .DLL to the input), though the procedure requires administrator privileges and supports ncacn_ip_tcp for potential remote exploitation. Defenders should monitor for suspicious DLL loads by the Print Spooler service and consider restricting RPC access to printer management functions, as this represents an admin-to-SYSTEM escalation path that could enable lateral movement in environments where attackers hold administrative credentials.
Read the full story