PetitPotam is an NTLM relay attack. It abuses the MS-EFSRPC interface to force a Windows machine to send its authentication details to an attacker, which can lead to full compromise of Windows domains running Active Directory Certificate Services. Microsoft describes protections in KB5005413. NVD lists CVE-2021-36942, a Windows LSA spoofing flaw, with a CVSS 3.1 score of 7.5 (high).
What Will You Find in This Report on the PetitPotam Vulnerability?
Learn Technical Method of Operation Details
The technical details of the Vulnerability, PetitPotam, and its abilities, infection methodologies, and more. The report will show many points about the PetitPotam’s technical details, detections, etc.
Gain Knowledge About Future Attacks
By understanding the vulnerability, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic.
What Does the PetitPotam Vulnerability Analysis Report Cover?
The report is 30 pages long. It carries the ID BD02112102, is dated 02.11.2021 and is written by the Threat Intelligence Team. Its main parts are Introduction, Vulnerability Analysis, Detection Phase, Exploitation, Mitigation and Measures, and a Conclusion.
Background Chapter
The introduction explains the building blocks first. It walks through how NTLM works in eight steps, what an NTLM relay attack is, and what EFSRPC and the SMB protocol do. It also describes the six components of Active Directory Certificate Services (AD CS).
Key Technical Findings
- The report says the weakness comes from the EfsRpcOpenFileRaw function of the MS-EFSRPC protocol. It can be triggered by sending an SMB request.
- It says that in efslsaext.dll, the EfsGetLocalFileName call sits outside the impersonation block. This causes NTLM credentials to be sent in SMB requests.
- It lists AD CS with Certificate Authority Web Enrollment or Certificate Enrollment Web Service as potentially vulnerable.
- It gives CVE-2021-36942 with a CVSS score of 7.5 and notes the August 2021 security update.
- The update blocks OpenEncryptedFileRawA and OpenEncryptedFileRawW calls through the LSARPC interface. The report warns that it may cause problems in the backup system.
How the Report Approaches Detection
The report gives two methods. The first looks for a domain controller account that requests a TGT from an IP address not on the domain controller list. The second looks at events with ANONYMOUS LOGON and Event IDs 5145, 5140 and 4624. It includes sample queries for these events.
Exploitation Walkthrough
The exploitation chapter describes a lab setup. It notes that a proof-of-concept tool was published on GitHub. It then shows, with figures, the steps from relay preparation to forcing authentication and requesting a Kerberos TGT.
Mitigation Steps in the Report
- Disable NTLM authentication through Group Policy.
- Enable Extended Protection for Authentication (EPA) for Certificate Authority Web Enrollment and enable the Require SSL option.
- Set “Network Security: Restrict NTLM: Incoming NTLM Traffic” to “Deny all accounts” or “Deny all domain accounts” on AD CS servers.
- Turn off NTLM for IIS on the AD CS servers by adding “Negotiate:Kerberos” under Windows Authentication.
Who Is It for?
Teams that run Windows domains with AD CS will find the detection and mitigation chapters the most useful. The report closes by saying that the security updates should be applied.