Unpatched 'PhantomRPC' Flaw in Windows Enables Privilege Escalation

An unpatched vulnerability can allow for privilege escalation across Windows systems through the abuse of the Remote Procedure Call (RPC) architecture in Microsoft's OS. Called PhantomRPC, the flaw stems from an architectural weakness in how RPC handles connections to unavailable services, according to Haidar Kabibo, a middle application security specialist at Kaspersky who discovered the flaw and shared his findings in a recent post on X and in a blog post published Friday. By exploiting the flaw, an attacker with limited local access can deploy a malicious RPC server that impersonates legitimate Windows services. In this way, when higher-privileged processes connect to the server, the attacker can impersonate them to escalate privileges to SYSTEM or administrator levels. "The operating system permits the deployment RPC servers using the same endpoint assigned to RPC servers exposed by legitimate services, provided that those services are not running," Kabibo tells Dark Reading. "This behavior enables any process to deploy an RPC server that mimics a legitimate service and receive all the RPC client calls originally intended for the authentic server." If some of these calls originate from highly privileged accounts, and the hosting process possesses the "SeImpersonatePrivilege," a low-privileged process may impersonate such clients and thereby escalate its privileges, he says, describing it in his X post as "an architecture problem." "The Microsoft Windows operating system i...