PetitPotam: Windows AD CS NTLM Relay Attack

Last month (July 2021) a security researcher, Topotam, released a Proof of Concept (PoC) exploit known as PetitPotam that would achieve a full compromise of a Windows domain running Active Directory Certificate Service (AD CS).

The Microsoft Advisory describes the security flaw as “a classic NTLM Relay Attack”, adding that “such attacks have been previously documented by Microsoft along with numerous mitigation options to protect customers”.

It is, however, generally accepted by the security community that PetitPotam differs from traditional NTLM relay attacks due to the lack of user interaction required to exploit the weakness.

Mitigating PetitPotam

The Microsoft Advisory, supported by guidance published in KB500413, recommends enabling Extended Protections for Authentication (EPA) and disabling HTTP on AD CS servers  as the primary mitigation, with an additional mitigation to disable NTLM authentication where possible.

It seemed clear that Microsoft did not intend to release an official patch for the vulnerability, which has been added to the Microsoft Won’t-Fix-List. Following significant scruitiny of this response from the cyber security community, a fix for this issue has been released as a part of the August 2021 Cumulative Updates.

The security researcher @gentilkiwi has also published RPC filters to block MS-EFSR calls in a Tweet, which are reported to successfully block remote connections and not local EFS usage. These should apparently be applied to all Domain Controllers to block the initial attack vector. However, this has not been widely adopted as effective mitigation as of yet.

Research continues into the extent of the exploitability and mitigation options for PetitPotam, with further tools and techniques both for attackers and defenders appearing regularly. Contact us today to discuss network and infrastructure penetration testing, which will verify PetitPotam vulnerabilities on your network.