> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/windows-privilege-escalation/eop-named-pipes.md).

# EoP - Named Pipes

## Named Pipe Exploitation: Identification and Mitigation Guide

### Key Concepts

* **Named Pipes**: Inter-process communication (IPC) mechanism used by Windows for data transfer between processes.
* **Discretionary Access Control List (DACL)**: Defines permissions for accessing named pipes.
* **Privilege Escalation**: Potentially gaining elevated privileges through exploitation of misconfigured named pipes.

***

### Step-by-Step Exploitation Process

#### **Step 1: Find Named Pipes**

Enumerate all named pipes on the system:

**PowerShell Command:**

```powershell
powershellCopy code$pipes = [System.IO.Directory]::GetFiles("\\.\pipe\")
$pipes
```

**Example Output:**

```plaintext
plaintextCopy code\\.\pipe\StdOutPipe
\\.\pipe\StdErrPipe
\\.\pipe\SomeOtherPipe
```

***

#### **Step 2: Check Named Pipe DACL**

Inspect the security permissions of the named pipes to identify weak configurations.

**Using `pipesec.exe`:**

```cmd
cmdCopy codepipesec.exe \\.\pipe\StdOutPipe
```

**Example Output:**

```plaintext
plaintextCopy codeNamed Pipe: \\.\pipe\StdOutPipe
Owner: NT AUTHORITY\SYSTEM
DACL: 
- ACE: Allow  Everyone   Read/Write
- ACE: Deny   SYSTEM      Read/Write
```

**Interpretation**: If `Everyone` has `Read/Write` access, the pipe is vulnerable to abuse.

***

#### **Step 3: Reverse Engineering Software**

Reverse engineer the software that interacts with the named pipes:

1. **Identify the Executable**: Use **Process Monitor (ProcMon)** to observe processes interacting with named pipes.
2. **Decompile the Application**: Use tools like:
   * **IDA Pro** or **Ghidra** for native binaries.
   * **dotPeek** for .NET applications.
3. **Analyze Pipe Interactions**: Focus on how the application reads/writes to named pipes and look for bypass opportunities.

***

#### **Step 4: Send Data Through the Named Pipe**

Write arbitrary data to the vulnerable named pipe:

**Command:**

```cmd
cmdCopy codeprogram.exe > \\.\pipe\StdOutPipe 2> \\.\pipe\StdErrPipe
```

* **`>`**: Redirects standard output (stdout) to the named pipe.
* **`2>`**: Redirects standard error (stderr) to another named pipe.

**Example Exploit:**

```cmd
cmdCopy codeecho "malicious command" > \\.\pipe\StdOutPipe
```

If the target application reads from `StdOutPipe`, it will process the malicious command as legitimate.

***

### Practical Example

#### Scenario

1. **Vulnerable Pipe**: `\\.\pipe\StdOutPipe` allows `Everyone` to write.
2. **Target Application**: A legitimate service listens to `StdOutPipe` for commands.

#### Exploit Steps:

1. **Inject Command**: Write a malicious command to the named pipe:

   ```cmd
   cmdCopy codeecho "shutdown /s" > \\.\pipe\StdOutPipe
   ```
2. **Result**: The application executes the malicious command, causing an unauthorized shutdown.

***

### Security Implications

* **Privilege Escalation**: Execute commands with elevated privileges by exploiting weak pipe permissions.
* **Data Leakage**: Intercept sensitive information from pipe communications.
* **Denial of Service (DoS)**: Overloading named pipes can cause legitimate processes to fail or hang.

***

### Mitigation Strategies

#### **1. Restrict DACLs**

Ensure named pipes have restrictive permissions. Use `icacls` or `pipesec` to configure permissions.

**Command:**

```cmd
cmdCopy codeicacls.exe "\\.\pipe\StdOutPipe" /deny Everyone:(W)
```

***

#### **2. Monitor Named Pipe Activity**

Deploy monitoring tools to log access and usage of named pipes. Look for unusual access patterns.

***

#### **3. Apply Principle of Least Privilege**

Limit user and process permissions to reduce the risk of exploitation.

***

#### **4. Regular Audits**

Conduct periodic security audits to identify misconfigured named pipes and correct improper permissions.

***

### Additional Resources

* [**Microsoft Security Documentation**](https://learn.microsoft.com/en-us/windows/security/)
* [**Sysinternals Tools**](https://learn.microsoft.com/en-us/sysinternals/)
* **OWASP: Top 10 Security Risks**

***

This guide outlines steps for identifying and mitigating named pipe vulnerabilities. Always adhere to ethical and legal guidelines during security assessments.