3

This is a question that personally as a security professional has bugged me for a long time.

So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-zero (0.0.0.0 for those that might be less familiar with the lingo) for what I'd imagine to be assistance with setup on a domain environment. A lot of these services, like Link-Local Name Resolution or NetBIOS, can be disabled, albeit with a little bit of work.

While I understand that the Windows RPC subsystem has a dependency of nearly every system-installed service, the RPC Endpoint Mapper will bind to the typical msrpc port (port 135) on all interfaces. In a high-security or home environment, listening RPC ports may be undesirable as it may invite potential exploits.

I've messed with some of these facts in a test environment, largely with trying to set the Windows RPC server to listen on the localhost. I've been using RPCCFG, disabling DCOM, the usual steps I find on some dated forums. I know it cannot be disabled entirely, so I've tried to make it at least visible in software under the impression that the functionality would largely remain the same: The mapper is there, just not listening on the hardware. From XP to 10, the only place I've gotten this to work is a Windows Server 2008 R2 Datacenter installation, and I haven't been able to replicate it since.

While I realize in a high-security environment it would be more desirable to just not use Windows with respect to the security concerns, the inability to configure this service and have it work without Windows throwing a CRITICAL_PROCESS_DIED. Call me an enthusiast, but it's always something I've found interesting.

So, can the Windows RPC subsystem listen on localhost without error? Or is it not configurable without breaking all functionality within Windows?

Improve this question
2
  • 2
    While I understand that you're asking this question in a security context, I think the question itself is not really infosec. Perhaps this should be moved to superuser.com?
    – Neil Smithline
    Sep 17, 2015 at 17:19
  • 1
    I'm not exactly sure it's the wrong place. If someone answers your question that's great but if people upvote my comment then it should probably be moved.
    – Neil Smithline
    Sep 17, 2015 at 19:07

1 Answer 1

Reset to default
1

Have you considered simply blocking the relevant ports at the firewall? Deny access from all external hosts. Using the "Windows Firewall with Advanced Networking" window (wf.msc), edit a rule, go to the Scope tab, and either set it to only work on local IP address 127.0.0.1, or to nor accept connections from any remote computers (or both). You could also add a rule that explicitly blocks connections to 135 from remote machines. Best to block both inbound and outbound, if you're really paranoid, since an attacker might present a malicious RPC server and attack you via returned data or callbacks.

I'll admit, I haven't tried this myself. Interested to hear if it works. Windows obviously doesn't require network RPC be available - the OS works fine without a network interface at all - but I expect some network functionality will stop working if you block all remote RPC endpoint mapping.

Improve this answer
3
  • The functionality you'll lose will be mostly the Windows remote management stuff (remotely accessing the registry, or shutting down the system, or so on). The highly user-exposed functions (SMB file- and printer-sharing, Remote Desktop, etc.) should be fine. Unsure about domain joining and Group Policy management.
    – CBHacking
    Sep 12, 2016 at 21:35
  • It works, but probably not reliably that way: Windows Update silently overwrites rules in Windows Firewall for components it updates.
    – user88348
    Jun 15, 2019 at 18:25
  • Oh, good point @anx . A custom rule might survive the overwrite, and deny takes precedence over allow so it would probably still work, but that's worth exploring. You can also change the ACL on the firewall rules to prevent SYSTEM from modifying them, but that might break other things and you can only do it on the set of rules, not on individual rules.
    – CBHacking
    Jun 17, 2019 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .