🔔Call and Register — Relay Attack on WinReg RPC Client

A critical vulnerability (CVE-2024-43532) has been identified in Microsoft’s Remote Registry client. This flaw allows attackers to exploit insecure fallback mechanisms in the WinReg client, enabling them to relay authentication details and make unauthorized certificate requests through Active Directory Certificate Services (ADCS).

🔗 Research:
https://www.akamai.com/blog/security-research/winreg-relay-vulnerability

🔗 RPC Visibility Tool:
https://github.com/akamai/akamai-security-research/tree/main/rpc_toolkit/rpc_visibility

🔗 PoC:
https://github.com/akamai/akamai-security-research/tree/main/PoCs/cve-2024-43532

#ad #adcs #rpc #ntlm #relay #etw #advapi