We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Diving into Windows Remote Access Service for Pre-Auth Bugs
Explore the Windows Remote Access Service (RAS) for pre-auth bugs, including L2TP vulnerabilities and bugs in SSTP, PPTP, and IKE protocols, and learn how to find and exploit these issues using fuzzing and manual auditing techniques.
- The talk focuses on diving into Windows Remote Access Service (RAS) for pre-auth bugs.
- Windows RAS protocol is L2TP and lack of multi-thread protection on a global timer array leads to bugs.
- The speaker researchers multiple targets, including SSTP, PPTP, and IKE protocols.
- Common bugs found include NDIS handle UAF, integer overflow, and resource leak.
- The speaker introduces a simple fuzzer and explains how it can be used to find bugs in RAS protocols.
- The fuzzer is able to find multiple crashes, including UAF and RCE bugs.
- The speaker suggests developing a mutation-based fuzzer and using both fuzzing and manual auditing.
- The talk highlights the importance of researching Windows RAS protocols, including SSTP, PPTP, and IKE.
- The speaker talks about the importance of code quality and keeping an eye out for RACE conditions.
- The talk also mentions the WIP bounty program and its attack scenario awards.