New PetitPotam NTLM Relay Attack Lets Hackers Take Over Windows Domains

A newly uncovered security flaw in the Windows operating system
can be exploited to coerce remote Windows servers, including Domain
Controllers, to authenticate with a malicious destination, thereby
allowing an adversary to stage an NTLM relay attack^[1]
and completely take over a Windows domain.

The issue, dubbed “PetitPotam^[2],” was discovered by
security researcher Gilles Lionel, who shared technical details and
proof-of-concept (PoC) code last week, noting that the flaw works
by forcing “Windows hosts to authenticate to other machines via
MS-EFSRPC EfsRpcOpenFileRaw function.”

MS-EFSRPC^[3]
is Microsoft’s Encrypting File System Remote Protocol that’s used
to perform “maintenance and management operations on encrypted data
that is stored remotely and accessed over a network.”

Specifically, the attack enables a domain controller to
authenticate against a remote NTLM under a bad actor’s control
using the MS-EFSRPC interface and share its authentication
information. This is done by connecting to LSARPC^[4], resulting in a scenario
where the target server connects to an arbitrary server and
performs NTLM authentication.

“An attacker can target a Domain Controller to send its
credentials by using the MS-EFSRPC protocol and then relaying the
DC NTLM credentials to the Active Directory Certificate Services AD
CS Web Enrollment pages to enroll a DC certificate,” TRUESEC’s
Hasain Alshakarti said^[5]. “This will effectively
give the attacker an authentication certificate that can be used to
access domain services as a DC and compromise the entire
domain.

While disabling support for MS-EFSRPC doesn’t stop the attack
from functioning, Microsoft has since issued mitigations^[6]
for the issue, while characterizing “PetitPotam” as a “classic NTLM relay attack^[7],” which permit attackers
with access to a network to intercept legitimate authentication
traffic between a client and a server and relay those validated
authentication requests in order to access network services.

“To prevent NTLM Relay Attacks on networks with NTLM enabled,
domain administrators must ensure that services that permit NTLM
authentication make use of protections such as Extended Protection
for Authentication (EPA) or signing features such as SMB signing,”
Microsoft noted. “PetitPotam takes advantage of servers where the
Active Directory Certificate Services (AD CS) is not configured
with protections for NTLM Relay Attacks.”

To safeguard against this line of attack, the Windows maker is
recommending that customers disable NTLM authentication on the
domain controller. In the event NTLM cannot be turned off for
compatibility reasons, the company is urging users to take one of
the two steps below –

• Disable NTLM^[8]
  on any AD CS Servers in your domain using the group policy Network
  security: Restrict NTLM: Incoming NTLM traffic.
• Disable NTLM for Internet Information Services (IIS) on AD CS
  Servers in the domain running the “Certificate Authority Web
  Enrollment” or “Certificate Enrollment Web Service” services

PetitPotam marks the third major Windows security issue
disclosed over the past month after the PrintNightmare^[9]
and SeriousSAM^[10] (aka HiveNightmare)
vulnerabilities.