NAMED PIPES ABUSE

PRIMARY CATEGORY → NAMED PIPES ABUSE

Enumeration

Existing Named Pipes

PS

dir \\.\pipe\

Pipelist.exe

pipelist.exe /accepteula

Named Pipes DACL

Accesschk.exe

Specific Named Pipe

accesschk.exe /accepteula \\.\Pipe\lsass -v

All existing Named Pipes

accesschk.exe /accepteula \pipe\* -v

Existing Named Pipe for which a User has Write Permissions

• Current User

accesschk.exe -accepteula -w <NAMED_PIPE> -v

• Specific User

accesschk.exe -accepteula -w <USER> <NAMED_PIPE> -v