Blessed RemotePotato0, the Last of the Potatoes

Patron of Windows relay attacks, the RPC protocol, and the long dynasty of potatoes.

Life

On 2 September 2021 Antonio Cocomazzi of SentinelOne described RemotePotato0, yet another privilege escalation flaw in the Windows RPC protocol. By tricking a more privileged user logged onto the same machine, one could force their account to authenticate and relay that authentication elsewhere, up to taking over the domain. It is the latest heir of a long family: Hot, Rotten, Juicy, Rogue and many other potatoes.

Prayer

O Blessed RemotePotato0, last tuber of a glorious line, let our authentications never be relayed to those who don't deserve them. Amen.

How to celebrate

Celebrated by applying the available micropatches and disabling NTLM relay where it isn't needed.

As long as there is RPC, there is a potato to harvest.