Share via

RemotePotato0: Privilege Escalation Vulnerability in Windows RPC Protocol

Duncan 56 Reputation points
2021-07-27T17:45:24.007+00:00

I have found this interesting article: https://borncity.com/win/2021/07/27/remotepotato0-privilege-escalation-schwachstelle-im-windows-rpc-protocol/

This article refers to: https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop/

The latter states that this so-called 'remotepotato0-privilege-escalation' has been reported to Microsoft: 11/30/2020 – Submitted vulnerability to MSRC case 62293

and lists a statement from MS: 4/13/2021 – Microsoft informed us that, after an extensive review, they determined that “Servers must defend themselves against NTLM relay attacks” (side note: setting the sign flag in NTLM provider as well as SPNEGO would have inhibited this exploit…)

Is there any CVE out there, which handles this case? Is there any OFFICIAL statement from Microsoft? Does anyone have more information on detailed mitigation for this exploit?

Windows for business | Windows Server | User experience | Other

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Buckleau 26 Reputation points
    2021-09-13T22:53:31.817+00:00

    This is also addressed in Microsoft article KB5005413 which has mitigations as well.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.