Security researcher Gilles Lionel (aka Topotam) has discovered a vulnerability in the Windows operating system that allows an attacker to force remote Windows machines to authenticate and share their password hashes with him. The news of the attack was first reported by The Record.
The attack abuse the Encrypting File System Remote (EFSRPC) protocol, which is used to perform maintenance and management operations on encrypted data that is stored remotely and accessed over a network.
Lionel also published a proof-of-concept (PoC) exploit code on GitHub.
“PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function. This is possible via other protocols and functions as well .” reads the description provided by the expert.
“The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it’s more prevalent. But it’s possible to trigger with the EFSRPC named pipe and interface df1941c5-fe89-4e79-bf10-463657acf44d.”
In the PetitPotam attack demonstrated by the expert, he sent SMB requests to a remote system’s MS-EFSRPC interface and forced its system to initiate an authentication procedure and share its NTLM authentication hash.
The NTLM authentication hash can be used to carry out a relay attack or can be lately cracked to obtain the victim’s password. The PetitPotam attack can be very dangerous because it allows attackers to take over a domain controller and compromise the entire organization.
Hi all,
— topotam (@topotam77) July 18, 2021
MS-RPRN to coerce machine authentication is great but the service is often disabled nowadays by admins on most orgz.
Here is one another way we use to elicit machine account auth via MS-EFSRPC. Enjoy!!https://t.co/AGiS4f6yt8
Gilles highlighted that disabling support for MS-EFSRPC did not work to mitigate this attack. At the time of this writing, there is no workaround to mitigate this issue.
Lionel told BleepingComputer, that this as a vulnerability but rather the abuse of a legitimate function.
The attack can potentially impact most of the supported Windows versions, it was successfully tested against Windows 10, Windows Server 2016, and Windows Server 2019 systems.
Mimikatz author Benjamin Delpy also successfully tested the PetitPotam attack and published a video PoC of the attack.
It's time to play with #mimikatz
—& #kekeo
& #impacket
If you have a Windows PKI with its WebServer, you'll have problems
No authentication/credential to *full domain owned*
> https://t.co/Wzb5GAfWfd
> https://t.co/x3n9B8HHGT@topotam77 EFS & PetitPotam
@ExAndroidDev PR pic.twitter.com/Z2qn1NM9zx
Benjamin Delpy (@gentilkiwi) July 23, 2021
Follow me on Twitter: @securityaffairs and Facebook
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, windows)
[adrotate banner=”5″]
[adrotate banner=”13″]