NtAlpcImpersonateClientOfPort

Prototype

NTSTATUS NtAlpcImpersonateClientOfPort(
  HANDLE                    PortHandle,
  PPORT_MESSAGE             Message,
  PALPC_IMPERSONATE_INFO    Flags
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 88 00 00 00      mov eax, 0x88
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtAlpcImpersonateClientOfPort` is the ALPC analogue of `ImpersonateNamedPipeClient`: the server thread that just received a message temporarily assumes the client's primary token, performs a privileged operation on the client's behalf, then calls `RevertToSelf`. The impersonation level is constrained by the client's `SECURITY_QUALITY_OF_SERVICE.ImpersonationLevel` at connect time, but a server requesting *Impersonate* with no client QoS override is the default for nearly every Windows service. Every Win32 / RPC `RpcImpersonateClient` call against an `ncalrpc` binding ends up here. Implementation is `AlpcpImpersonateClient` in `ntoskrnl.exe`, which calls `SeImpersonateClientEx`.

Common malware usage

**This is the highest-value ALPC syscall for privilege escalation** — but, critically, the bug is almost always in the *caller*, not in the syscall itself. The pattern: a SYSTEM-running service exposes an ALPC endpoint, accepts a connection from an unprivileged client, impersonates the client to do an access check ("is this user allowed to delete this file?"), then **forgets to revert** before performing the privileged action — or performs the check on a different object than the one acted upon (a TOCTOU). CVE-2018-8440 (SandboxEscaper's Task Scheduler ALPC LPE), CVE-2019-1130 (UMPS impersonation), CVE-2020-0668 (Windows Service Tracing LPE) and several Print-Spooler PrintNightmare variants all hinge on this kind of impersonation-misuse. Malware doesn't usually *call* this syscall — it sends the right ALPC message at the right moment to trick a SYSTEM service that does.

Detection opportunities

On the *caller* side: the syscall is invoked by essentially every Windows RPC server on every message — useless as a primary signal. On the *exploit* side: focus on the consequences. Sysmon Event ID 1 (Process Create) with `ParentImage=services.exe` / `spoolsv.exe` / `taskschd.exe` and `User=SYSTEM` but a token whose `IntegrityLevel` doesn't match expectations is a strong signal. ETW `Microsoft-Windows-Security-Auditing` Event ID 4624 (logon) with logon-type 9 (NewCredentials) bursts from a service host are suspicious. Kernel-level mitigations (Microsoft's `ImpersonateCheck` family, `RpcServerRegisterAuthInfoExW` with restricted SIDs) reduce exposure more reliably than detection rules.

Direct syscall examples

; Direct syscall stub for NtAlpcImpersonateClientOfPort (SSN 0x88 on Win11 24H2)
NtAlpcImpersonateClientOfPort PROC
    mov  r10, rcx          ; PortHandle
    mov  eax, 88h          ; SSN — drifts per build
    syscall
    ret
NtAlpcImpersonateClientOfPort ENDP

// The bug class lives in callers that forget RevertToSelf, or that
// perform the privileged work on a different object than the one checked.
#include <windows.h>
#include <winternl.h>

typedef struct _ALPC_IMPERSONATE_INFO {
    SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
    ULONG Flags;
    ULONG RequiredImpersonationLevel;
} ALPC_IMPERSONATE_INFO, *PALPC_IMPERSONATE_INFO;

typedef NTSTATUS (NTAPI *pNtAlpcImpersonateClientOfPort)(
    HANDLE, PPORT_MESSAGE, PALPC_IMPERSONATE_INFO);

NTSTATUS DoAsClient(HANDLE hCommPort, PPORT_MESSAGE pMsg,
                    NTSTATUS (*work)(void)) {
    pNtAlpcImpersonateClientOfPort imp = (pNtAlpcImpersonateClientOfPort)
        GetProcAddress(GetModuleHandleA("ntdll.dll"),
                       "NtAlpcImpersonateClientOfPort");
    NTSTATUS st = imp(hCommPort, pMsg, NULL /* default QoS */);
    if (!NT_SUCCESS(st)) return st;
    st = work();              // ALL privileged work happens here
    RevertToSelf();           // NEVER skip — exploit class is forgetting this
    return st;
}

// Real ALPC LPE chains (CVE-2018-8440, CVE-2020-0668, PrintNightmare variants)
// trick a privileged service into calling NtAlpcImpersonateClientOfPort against
// an attacker-controlled message, then performing FS / registry I/O AFTER the
// impersonation has either been reverted or never applied to the right object.
// The syscall itself behaves correctly — the vulnerability lives in the service.
// This file documents the syscall only; PoCs belong with the CVE references.

MITRE ATT&CK mappings

• T1068Exploitation for Privilege Escalationmitre ↗
• T1134.001Access Token Manipulation: Token Impersonation/Theftmitre ↗
• T1106Native APImitre ↗