Windows icon, symbol on the button, keyboard laptop closeup. Win

PetitPotam: Windows AD CS NTLM Relay Attack


11th August 2021

2 min read

Last month (July 2021) a security researcher, Topotam, released a Proof of Concept (PoC) exploit known as PetitPotam that would achieve a full compromise of a Windows domain running Active Directory Certificate Service (AD CS).

The Microsoft Advisory describes the security flaw as “a classic NTLM Relay Attack”, adding that “such attacks have been previously documented by Microsoft along with numerous mitigation options to protect customers”.

It is, however, generally accepted by the security community that PetitPotam differs from traditional NTLM relay attacks due to the lack of user interaction required to exploit the weakness.

Mitigating PetitPotam

The Microsoft Advisory, supported by guidance published in KB500413, recommends enabling Extended Protections for Authentication (EPA) and disabling HTTP on AD CS servers  as the primary mitigation, with an additional mitigation to disable NTLM authentication where possible.

It seemed clear that Microsoft did not intend to release an official patch for the vulnerability, which has been added to the Microsoft Won’t-Fix-List. Following significant scruitiny of this response from the cyber security community, a fix for this issue has been released as a part of the August 2021 Cumulative Updates.

The security researcher @gentilkiwi has also published RPC filters to block MS-EFSR calls in a Tweet, which are reported to successfully block remote connections and not local EFS usage. These should apparently be applied to all Domain Controllers to block the initial attack vector. However, this has not been widely adopted as effective mitigation as of yet.

Research continues into the extent of the exploitability and mitigation options for PetitPotam, with further tools and techniques both for attackers and defenders appearing regularly. Contact us today to discuss network and infrastructure penetration testing, which will verify PetitPotam vulnerabilities on your network.


  • Insights
  • Labs
API penetration testing

Securing APIs through penetration testing

APIs (Application Programming Interfaces) have become the backbone of many modern applications, and indeed the foundation of some businesses services. APIs enable seamless communication between…

The importance of a post-penetration test action plan

The importance of a post-penetration test action plan

As cyber threats continue to evolve and become more sophisticated, businesses must stay one step ahead in protecting their sensitive data and network infrastructure. Penetration…

How to choose the right penetration testing partner

How to choose the right penetration testing partner for your business

In today’s digital landscape, cybersecurity threats are evolving at an alarming rate. With the growing number of cyber-attacks and data breaches, businesses must prioritise their…

IoT device security, penetration testing

Securing the Internet of Things: Penetration testing’s role in IoT device security

The world is witnessing a remarkable transformation as more devices become interconnected, forming what’s known as the Internet of Things (IoT). From smart refrigerators and…

Man working as a junior penetration tester

My first month working as a junior penetration tester

Entering the world of cyber security as a junior penetration tester has been an eye-opening experience for me. In my first month, I’ve encountered challenges,…

The role of penetration testing in cybersecurity

The role of penetration testing in cybersecurity

Cybersecurity forms the backbone of safeguarding your business’s data. With cybercrime becoming more sophisticated, traditional security measures are often insufficient. Staying vigilant and proactive is…

Password cracking: How to crack a password

An introduction to password security: How to crack a password

Online Password Cracking An online attack is performed in real-time, against live services or applications to compromise active user accounts. Such attacks typically occur when…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…