MS-EVEN abuse (CheeseOunce)
Last updated
Was this helpful?
Last updated
Was this helpful?
MS-EVEN is Microsoft's EventLog Remoting Protocol. It provides an RPC interface for reading events in both live and backup event logs on remote computers. That interface is available through \PIPE\eventlog SMB named pipe.
We can abuse this protocol to coerce authentications. Similarly to other MS-RPC abuses, this works by using a specific method relying on remote address. In this case, the ElfrOpenBELW method was detected vulnerable.
The following Python proof-of-concept (https://github.com/evilashz/CheeseOunce) implements the ElfrOpenBELW method.
Another alternative is to use the Coercer tool (python) as follow.
