NtImpersonateClientOfPort

Prototype

NTSTATUS NtImpersonateClientOfPort(
  HANDLE        PortHandle,
  PPORT_MESSAGE Message
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 1F 00 00 00      mov eax, 0x1F
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Pre-ALPC sibling of NtAlpcImpersonateClientOfPort. Modern Windows components have moved to ALPC, but a handful of legacy ports remain in ntoskrnl and a few user-mode services for compatibility. The SSN has been pinned at `0x1F` from Windows 10 1507 through 11 24H2 — a strong hint that the call is in maintenance, not active development. Returns STATUS_ACCESS_DENIED unless either (a) the client previously granted impersonation via DynamicTracking + a sufficient SecurityQualityOfService, or (b) the server holds SeImpersonatePrivilege.

Common malware usage

Same fundamental bug class as NtAlpcImpersonateClientOfPort: a server that does not validate which client it is impersonating, or that forgets to check the caller-supplied PORT_MESSAGE against the message it actually pulled off the queue, can be coaxed into assuming the security context of a more privileged client. Historical exploitation patterns are well documented (Token Kidnapping research by Cesar Cerrudo, various Project Zero LPC findings), but the modern attack mass has moved to ALPC where the volume of legitimate calls is enormous and blends better. Direct exploitation of NtImpersonateClientOfPort is rare today and largely confined to legacy targets.

Detection opportunities

Volume of legitimate calls in 2025 is small enough that defenders can baseline aggressively: enumerate every process that has ever called it and treat outliers as suspect. ETW Microsoft-Windows-Kernel-Audit-API-Calls and the Threat Intelligence provider both emit impersonation transitions. Sysmon Event ID 4 (driver loaded) is unrelated, but EID 1 process create + subsequent token impersonation transitions (logged via PsSetCreateThreadNotifyRoutineEx-fed sensors) are the practical fallback. SeImpersonatePrivilege grants on the calling token are an excellent precursor signal.

Direct syscall examples

; Direct syscall stub for NtImpersonateClientOfPort (SSN 0x1F, stable across builds)
NtImpersonateClientOfPort PROC
    mov  r10, rcx
    mov  eax, 1Fh
    syscall
    ret
NtImpersonateClientOfPort ENDP

// Server side of a legacy LPC port. Once a client has connected and sent a request,
// the server can briefly act as that client to perform a privileged operation on
// the client's behalf. This is the same shape as the early-2000s "Token Kidnapping"
// research where missing caller-message validation led to EoP.
NTSTATUS handle_client_request(HANDLE PortHandle, PPORT_MESSAGE Msg) {
    NTSTATUS s = NtImpersonateClientOfPort(PortHandle, Msg);
    if (!NT_SUCCESS(s)) return s;

    // *** Now running with the client's token ***
    // do_privileged_thing_on_behalf_of_client();

    RevertToSelf();
    return s;
}

MITRE ATT&CK mappings

• T1134Access Token Manipulationmitre ↗
• T1134.001Token Impersonation/Theftmitre ↗
• T1068Exploitation for Privilege Escalationmitre ↗