Horizon3.ai
Horizon3.ai

Microsoft Windows Machine Account NTLM Coercion via Authenticated MS-RPRN

by | Jun 20, 2023 | Fix Actions

Block remote MS-RPRN functionality with RPC Filters

If Microsoft Print System Remote Protocol (MS-RPRN) is not required, administrators should block the remote MS-RPRN functionality on the vulnerable host using RPC filters.

    1. Create a text file with the following content: 
      rpc
filter
add rule layer=um actiontype=block
add condition field=if_uuid matchtype=equal data=12345678-1234-ABCD-EF00-0123456789AB
add filter
quit
    2. Use the netsh command line utility to import the RPC filter from an elevated administrator prompt:
      netsh -f <FILTER_FILE_NAME>
    3. To confirm the filters are in place, you can view the current RPC filters using the following command:
      netsh rpc filter show filter

See CERT Coordination Center Vulnerability Note VU:#405600 for additional details on protecting Active Directory Certificate Services from NTLM relay attacks.