Hello, how is it with RCE? Analyzing a vulnerability in the ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://habr.com/ru/companies/pt/articles/984934/
• Blog Title: Hello, how is it with RCE? Analyzing a vulnerability in the Windows Telephony service
• Suggested Section: Windows Hardening -> Windows Local Privilege Escalation (or Network Services Pentesting -> MSRPC/SMB named pipes) with a new page about 'TapiSrv/MS-TRP (tapsrv) arbitrary file write via mailslot path confusion -> tsec.ini overwrite -> LoadLibrary RCE (CVE-2026-20931)'

🎯 Content Summary

Post topic
The post analyzes CVE-2026-20931, a remote code execution vulnerability in the Windows Server Telephony service TapiSrv (implementation in tapisrv.dll), which runs as NETWORK SERVICE. Exploitation is possible only when Telephony is configured in “server mode” (remote clients allowed).

1) How Windows Telephony works (TAPI → TapiSrv → TSP)
Windows exposes telephony features via <a href="https://learn.mi...

🔧 Technical Details

Arbitrary file write via MS-TRP pull-mode mailslot confusion: If a service opens “mailslots” using file APIs, and it accepts a client-supplied mailslot path that is not validated (no enforcement of \\*\MAILSLOT\ semantics), an attacker can supply an arbitrary filesystem path. If the service calls CreateFileW(path, GENERIC_WRITE, ..., OPEN_EXISTING), it will open an existing file for writing and later write event/notification bytes into it. When the written notification value is derived from attacker-controlled request fields (here: a 4-byte InitContext), the attacker can repeatedly trigger events to write chosen 4-byte chunks to a chosen target file (subject to the service account’s write permissions).

Deterministic event triggering to drive writes: When event delivery is the only mechanism that causes writes, find an API/RPC handler that reliably generates events without requiring complex state (here: a “notify highest prio...

🤖 Agent Actions

Updated network-services-pentesting/135-pentesting-msrpc.md with a new section detailing the TapiSrv/MS-TRP tapsrv named-pipe vulnerability chain (CVE-2026-20931): remote exposure prerequisites, mailslot path confusion → 4-byte arbitrary file overwrite via InitContext, deterministic write trigger using request-recipient priority, tsec.ini overwrite to gain telephony-admin flags, and LoadLibrary-based RCE via GetUIDllName (with local DLL drop fallbacks). Added references for MS-TRP spec and the blog source.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://habr.com/ru/companies/pt/articles/984934/

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Windows Local Privilege Escalation (or Network Services Pentesting -> MSRPC/SMB named pipes) with a new page about 'TapiSrv/MS-TRP (tapsrv) arbitrary file write via mailslot path confusion -> tsec.ini overwrite -> LoadLibrary RCE (CVE-2026-20931)'".

Repository Maintenance:

• MD Files Formatting: 939 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0