Windows Exploitation Tricks: Spoofing Named Pipe Client PID

Re:Windows Exploitation Tricks: Spoofing Named Pipe Client PID by mehrdadn on Sunday October 06, 2019 @03:02AM (#21170318)

Summary of the takeaway: the GetNamedPipeClientProcessId function returns the PID of the process that opened the pipe, not the one that is currently communicating. However, the client PID can sometimes be specified manually, and even when it can't, handle duplication followed by PID recycling can make this PID point to an arbitrary process (hence it should not be used for security checks).

[ Parent | on HN ]

Re:Windows Exploitation Tricks: Spoofing Named Pipe Client PID by ammmir on Sunday October 06, 2019 @10:45AM (#21172344)

Wouldn't it be better to return a kind of ENOENT status if the process creating the pipe has disappeared (or its PID recycled)? Seems like a design flaw since PIDs have finite lifetimes and not communicating that through any API call return could pose a potentially serious security issue.

[ Parent | on HN ]

Re:Windows Exploitation Tricks: Spoofing Named Pipe Client PID by tinus_hn on Sunday October 06, 2019 @10:41AM (#21172318)

So what is the use of this function?

[ Parent | on HN ]

Re:Windows Exploitation Tricks: Spoofing Named Pipe Client PID by londons_explore on Sunday October 06, 2019 @01:52PM (#21173604)

Perhaps just for putting an informative PID in log messages?

[ Parent | on HN ]