PetitPotam: Windows AD CS NTLM Relay Attack

PetitPotam: Windows AD CS NTLM Relay Attack

Aug 11th 2021

Last month (July 2021) a security researcher, Topotam, released a Proof of Concept (PoC) exploit that would achieve a full compromise of a Windows domain running Active Directory Certificate Service (AD CS).

The Microsoft Advisory describes the security flaw as “a classic NTLM Relay Attack”, adding that “such attacks have been previously documented by Microsoft along with numerous mitigation options to protect customers”.

It is, however, generally accepted by the security community that PetitPotam differs from traditional NTLM relay attacks due to the lack of user interaction required to exploit the weakness.

Mitigating the weakness

The Microsoft Advisory, supported by guidance published in KB500413, recommends enabling Extended Protections for Authentication (EPA) and disabling HTTP on AD CS servers  as the primary mitigation, with an additional mitigation to disable NTLM authentication where possible.

It seemed clear that Microsoft did not intend to release an official patch for the vulnerability, which has been added to the Microsoft Won’t-Fix-List. Following significant scruitiny of this response from the cyber security community, a fix for this issue has been released as a part of the August 2021 Cumulative Updates.

The security researcher @gentilkiwi has also published RPC filters to block MS-EFSR calls in a Tweet, which are reported to successfully block remote connections and not local EFS usage. These should apparently be applied to all Domain Controllers to block the initial attack vector. However, this has not been widely adopted as effective mitigation as of yet.

Research continues into the extent of the exploitability and mitigation options for PetitPotam, with further tools and techniques both for attackers and defenders appearing regularly.

Exchange-Exploit

New Exchange RCE vulnerability actively exploited

How effective is secure code review for discovering vulnerabilities?

How effective is secure code review for discoveri...

Application Security (AppSec)

Application Security (AppSec)

Dealing with Dependencies

Enhancing Security in your Software Development L...

Exchange Server Emergency Mitigation Service

Exchange Server Emergency Mitigation Service

VMware

VMware vCenter Critical RCE Vulnerability

OWASP

OWASP Top 10 2021 Released

Introduction to Windows 11 (Beta) Security

Introduction to Windows 11 (Beta) Security

HTTP/3 and QUIC: A new era of speed and security

HTTP/3 and QUIC: A new era of speed and security?

Microsoft reports open redirection phishing tactic

Microsoft reports open redirection phishing tactics

Fortinet WAF allows remote code execution

Fortinet WAF allows remote code execution

Microsoft Exchange Bugs

Microsoft Exchange Proxy Vulnerabilities

What is penetration testing and why is it important to use a CREST-approved provider?

What is penetration testing and why is it importa...

What to do after your penetration testing report

What should you do after your penetration testin...

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud mig...

How secure use of the cloud can transform your business

How secure use of the cloud can digitally transfo...

What is crest and how does it benefit you?

What is CREST and what are the benefits of using ...

How can the 10 steps to cyber security help to protect your organisation?

How can the 10 steps to cyber security help to pr...

The importance of cyber security

Celebrating Sentrium’s contribution to cyber secu...

What is OWASP Application Security

What is OWASP application security?

Pentration testing report

What should you do after your penetration testing...

Protect against a phishing attack

How to protect against a phishing attack

Secure data in cloud computing

How to secure data in cloud computing

The Security risks of cloud computing

What are the security risks of cloud computing?

Maintain security when employees work remotely

How to maintain security when employees work remo...

Identify and avoid phishing attacks

How to identify and avoid phishing attacks

Penetration testing

What is penetration testing and why is it important?
  • Left Arrow Icon
  • Right Arrow Icon