Inter-Process Communication (IPC) Windows

Introduction

Inter-process communication (IPC) allows distinct processes to exchange data and synchronize. It is a fundamental concept of modern operating systems, essential for understanding how applications communicate with each other.

Why IPC is important

In a modern operating system:

• Applications are often composed of multiple processes
• System services need to communicate with each other
• Clients and servers exchange data
• Security depends on proper process isolation

Windows IPC Mechanisms

Overview

Mechanism	Type	Scope	Performance	Use Cases
Anonymous Pipes	Stream	Local	High	Parent-child
Named Pipes	Stream	Network	High	Services, RPC
Mailslots	Datagram	Network	Medium	Broadcast
Shared Memory	Direct	Local	Very high	High performance
Sockets	Stream/Datagram	Network	Variable	Network applications
COM/DCOM	RPC	Local/Network	Medium	Windows integration
WMI	Query	Local/Network	Low	Administration

---

Anonymous Pipes

Definition

An anonymous pipe is a unidirectional communication channel between two related processes (usually parent-child).

Characteristics

• Unidirectional communication
• No name, thus not accessible by other processes
• Created by the parent process
• Inherited by the child process
• No network access

Command Line Example

dir | findstr "txt"

The | character creates an anonymous pipe:

1. dir writes its output to the pipe
2. findstr reads from the pipe
3. Data flows from one to the other

Usage in Programming

// Simplified pseudo-code
HANDLE hReadPipe, hWritePipe;
CreatePipe(&hReadPipe, &hWritePipe, NULL, 0);

// Parent writes to hWritePipe
// Child reads from hReadPipe

---

Named Pipes

Definition

A named pipe is a bidirectional communication channel accessible by its name, capable of crossing the network.

Characteristics

• Bidirectional communication
• Accessible by name: \\.\pipe\PipeName
• Can cross the network: \\server\pipe\PipeName
• Supports ACLs (Access Control Lists)
• Message or byte stream mode

Name Format

\\.\pipe\MyPipe           (local)
\\server\pipe\MyPipe      (remote)
\\127.0.0.1\pipe\MyPipe   (localhost)

Pipe Enumeration

PowerShell:

# List all active pipes
Get-ChildItem \\.\pipe\

# Alternative method
[System.IO.Directory]::GetFiles("\\.\pipe\")

With PipeList (Sysinternals):

pipelist.exe /accepteula

Common Windows Pipes

Pipe	Service
\pipe\lsarpc	LSA (Local Security Authority)
\pipe\samr	SAM (Security Account Manager)
\pipe\netlogon	Netlogon service
\pipe\srvsvc	Server service
\pipe\wkssvc	Workstation service
\pipe\spoolss	Print Spooler

Security Implications

Named pipes are used for:

• Communication with Windows services
• Remote Procedure Calls (RPC)
• Token impersonation (security risk)
• Privilege escalation techniques (Potato attacks)

---

Shared Memory

Definition

Shared memory allows multiple processes to access the same region of physical memory.

Characteristics

• Direct memory access (very fast)
• Requires manual synchronization
• Local only
• Implemented via File Mapping on Windows

Creation in PowerShell

# Create a shared memory area
Add-Type -TypeDefinition @"
using System;
using System.IO.MemoryMappedFiles;

public class SharedMem {
    public static MemoryMappedFile Create(string name, long size) {
        return MemoryMappedFile.CreateNew(name, size);
    }
}
"@

$mmf = [SharedMem]::Create("MyShare", 1024)

Use Cases

• High-performance applications
• Sharing large data
• Fast local inter-process communication

---

Sockets

Definition

Sockets enable network communication between processes, locally or on remote machines.

Socket Types

Type	Protocol	Characteristics
Stream	TCP	Reliable, ordered connection
Datagram	UDP	Connectionless, fast
Raw	IP	Low-level access

Common Windows Ports

Port	Service	Risk
80	HTTP	Web attacks
443	HTTPS	Web attacks
445	SMB	EternalBlue, lateral movement
3389	RDP	Brute force, BlueKeep
5985	WinRM HTTP	Remote execution
5986	WinRM HTTPS	Remote execution
135	RPC	DCOM attacks

Simple TCP Server Example

# Basic TCP server
$listener = [System.Net.Sockets.TcpListener]::new([System.Net.IPAddress]::Any, 8080)
$listener.Start()
Write-Host "Server listening on port 8080..."

$client = $listener.AcceptTcpClient()
$stream = $client.GetStream()
$reader = [System.IO.StreamReader]::new($stream)
$message = $reader.ReadLine()
Write-Host "Received: $message"

$client.Close()
$listener.Stop()

---

COM and DCOM

COM (Component Object Model)

COM is a Microsoft framework for creating reusable software components.

Characteristics:

• Objects accessible via interfaces
• Language-independent
• Used by Office, Shell, Explorer

PowerShell Example:

# Create a COM Excel object
$excel = New-Object -ComObject Excel.Application
$excel.Visible = $true
$excel.Quit()

DCOM (Distributed COM)

DCOM extends COM to allow network communication.

Security Risks:

• Used for lateral movement in pentesting
• Techniques: MMC20, ShellBrowserWindow, Excel DDE
• Port 135 (RPC) + dynamic ports

---

WMI (Windows Management Instrumentation)

Definition

WMI is Microsoft's implementation of WBEM (Web-Based Enterprise Management), allowing management and querying of Windows systems.

Basic Usage

# System information
Get-WmiObject Win32_OperatingSystem

# Processes
Get-WmiObject Win32_Process | Select-Object Name, ProcessId

# Services
Get-WmiObject Win32_Service | Where-Object {$_.State -eq "Running"}

# Remotely
Get-WmiObject -ComputerName "RemoteServer" -Class Win32_OperatingSystem

WMI for Remote Administration

# Execute a command remotely via WMI
Invoke-WmiMethod -ComputerName "Target" -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami > C:\result.txt"

Security Implications

WMI is used for:

• Legitimate remote administration
• Lateral movement (wmic /node:)
• Persistence via WMI Event Subscriptions
• Fileless code execution

---

Comparative Table

Criterion	Pipes	Named Pipes	Shared Memory	Sockets	COM/DCOM	WMI
Network	No	Yes	No	Yes	Yes	Yes
Performance	High	High	Very high	Variable	Medium	Low
Security	ACL	ACL	ACL	Firewall	DCOM config	WMI namespace
Complexity	Low	Medium	High	Medium	High	Medium
Bidirectional	No	Yes	Yes	Yes	Yes	Yes

---

IPC Security

Common Attack Vectors

1. Named Pipes:

   • Token impersonation
   • Potato attacks (PrintSpoofer, JuicyPotato)
   • C2 communication (Cobalt Strike)

2. DCOM:

   • Lateral movement
   • Remote code execution

3. WMI:

   • Remote execution
   • Persistence via subscriptions
   • Reconnaissance

4. Sockets:

   • Reverse shells
   • Backdoors
   • Exfiltration

Detection

Sysmon Events:

• Event ID 17: Pipe created
• Event ID 18: Pipe connected

PowerShell:

# Detect suspicious pipes
Get-ChildItem \\.\pipe\ | Where-Object {
    $_.Name -notmatch "^(lsarpc|samr|netlogon|srvsvc|wkssvc)"
}

---

Practical Exercise

1. List all active named pipes on your system
2. Identify which process uses each pipe
3. Create a simple pipe server and client in PowerShell
4. Test the communication

---

References

• Microsoft Docs: Interprocess Communications
• Named Pipes
• WMI Documentation
• COM Technical Overview