PipeViewer – A Tool That Shows Detailed Information About Named Pipes In Windows
The tool was published as part of a research about Docker named pipes:
“Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 1″
“Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 2″
Overview
PipeViewer is a GUI tool that allows users to view details about Windows Named pipes and their permissions. It is designed to be useful for security researchers who are interested in searching for named pipes with weak permissions or testing the security of named pipes. With PipeViewer, users can easily view and analyze information about named pipes on their systems, helping them to identify potential security vulnerabilities and take appropriate steps to secure their systems.
Usage
Double-click the EXE binary and you will get the list of all named pipes.
Build
We used Visual Studio to compile it.
When downloading it from GitHub you might get error of block files, you can use PowerShell to unblock them:
Get-ChildItem -Path 'D:\tmp\PipeViewer-main' -Recurse | Unblock-FileWarning
We built the project and uploaded it so you can find it in the releases.
One problem is that the binary will trigger alerts from Windows Defender because it uses the NtObjerManager package which is flagged as virus.
Note that James Forshaw talked about it here.
We can’t change it because we depend on third-party DLL.
Features
- A detailed overview of named pipes.
- Filter\highlight rows based on cells.
- Bold specific rows.
- Export\Import to\from JSON.
- PipeChat – create a connection with available named pipes.
Demo
Credit
We want to thank James Forshaw (@tyranid) for creating the open source NtApiDotNet which allowed us to get information about named pipes.
License
Copyright (c) 2023 CyberArk Software Ltd. All rights reserved
This repository is licensed under Apache-2.0 License – see LICENSE for more details.
References
For more comments, suggestions or questions, you can contact Eviatar Gerzi (@g3rzi) and CyberArk Labs.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
