Can Get-RpcAlpcServer retrieve information from process inside a container?

[googleprojectzero]

Can Get-RpcAlpcServer retrieve information from process inside a container?

[tyranid]

It might work if I expand the check to find \RPC Control\ anywhere in the name. This also affects AppContainers as well so might be worth doing. You could try and do it manually by extracting the path to the ALPC Port and then using the Get-RpcEndpoint command instead. e.g.

$name = (Get-NtHandle -ProcessId <PID OF EXE> | ? ObjectType -eq 'ALPC Port' | ? Name -Match 'RPC Control').Name
Get-RpcEndpoint -AlpcPort $name

I've not tested that though.

[g3rzi]

Yes, it does the job, thank you :)

PS C:\Users\Administrator> $name = (Get-NtHandle -ProcessId 4880 | ? ObjectType -eq 'ALPC Port' | ? Name -Match 'RPC Control').Name
PS C:\Users\Administrator> Get-RpcEndpoint -AlpcPort $name

UUID                                 Version Protocol Endpoint                        Annotation
----                                 ------- -------- --------                        ----------
75ef42c7-22f4-44a0-8200-9351cd316e01 1.0     ncalrpc  \Silos\532\RPC Control\cexecsvc