Calling Local Windows RPC Servers from .NET

Summary: Project Zero's James Forshaw released tooling in his Sandbox Analysis Tools repository that lets .NET and PowerShell code call Local Windows RPC servers directly, including a client generator that parses RPC server information and emits C# source. He demonstrated it with a previously undocumented UAC bypass in the APPINFO service's RAiLaunchAdminProcess function, where the CreateFlags parameter is passed through to CreateProcessAsUser, allowing DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS to enable debugging on an elevated process.
Why it matters: The bypass works because the RPC server forwards caller-supplied CreateFlags to CreateProcessAsUser with only CREATE_UNICODE_ENVIRONMENT checked, so a debug flag turns an elevated process into a full-access handle; Microsoft treats this class of UAC bypass as outside its security boundary, meaning it will not be fixed in a security bulletin.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026