Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Detecting and Mitigating the PetitPotam Attack on Windows Domains

semperis.com | blog | #active-directory | #mitigation | #adcs | #esc8 | #ntlm-relay | #petitpotam

Summary

How the PetitPotam attack works: EFSRPC authentication coercion relayed via NTLM to AD CS Web Enrollment (ESC8) can yield Domain Admin; the post maps the full chain and covers detection plus mitigations like disabling NTLM or enabling EPA.
Published
Collected

original ↗

Related coverage

blog · blog.sentry.security
ESC8 Attack Guide for Windows Environments
The ESC8 attack abuses AD CS Web Enrollment with NTLM relay: coercing a DC to authenticate hands attackers a certificate as that high-privilege account, potentially compromising the entire domain.
blog · abdulmhsblog.com
When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss
A pentester notes Certify and Certipy can misjudge ESC8 NTLM relay exposure: even with EPA enabled, AD CS Web Enrollment may stay relayable when channel or service binding isn't configured right.
research · projectblack.io
Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled
Fixing ESC8: when ADCS web enrolment is reachable over HTTP or lacks Channel Binding/EPA, a relay attack can obtain a domain controller certificate. The fix is requiring EPA and SSL in IIS.
blog · semperis.com
How to Defend Against an NTLM Relay Attack
NTLM relay exploits the protocol's lack of mutual authentication: attackers capture and relay authentication sessions to other services, as in PetitPotam. Covers detection and SMB-signing defenses.
blog · abdulmhsblog.com
ESC8s and Where to Find Them
How to locate AD CS Web Enrollment endpoints for ESC8 relay attacks by enumerating constrained delegation with nxc and BloodHound, then confirming certsrv endpoints with curl before relaying.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
back