+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Securing a Windows Environment Against Remote Attacks (/showthread.php?tid=6082864)
Securing a Windows Environment Against Remote Attacks - veiled - May 29, 2020
Disable RPC calls.
here are the core services that depend on rpc
Code
Background Intelligent Transfer Service
COM+ Event System
Distributed Link Tacking Client
Distributed Transaction Coordinator
Fax Service
Indexing Service
IPSec Policy Agent
Messenger
Network Connections
Print Spooler
Protected Storage
Removable Storage
Routing Information Protocol (RIP) Listener
Routing and Remote Access
Task Scheduler
Telephony
Telnet
Windows Installer
Windows Management InstrumentationIn an Enterprise network, honestly, you wouldn't really need RPC calls for any business essential features.
RE: Securing a Windows Environment Against Remote Attacks - 13uNkNoWn - May 31, 2020
(May 29, 2020 12:32 PM)veiled Wrote: Disable RPC calls.
In an Enterprise network, honestly, you wouldn't really need RPC calls for any business essential features.
lol.. you want to check your information, if you really believe this.
I would fire you on the spot if you were a sysadmin and said this to me.
RE: Securing a Windows Environment Against Remote Attacks - Ampere - May 31, 2020
Pretty incorrect since the majority of SysAdmin tasks rely on some basic RPC functions such as Network Connections and WMIC for enterprise system management.
You're better off securing against untrusted RPC Calls then removing them entirely.
RE: Securing a Windows Environment Against Remote Attacks - veiled - Jun 1, 2020
Quote:lol.. you want to check your information, if you really believe this.
I would fire you on the spot if you were a sysadmin and said this to me.
Luckily I'm not a system administrator.