Pierluigi Paganini
July 24, 2021
Security researcher Gilles Lionel (aka Topotam) has discovered a vulnerability in the Windows operating system that allows an attacker to force remote Windows machines to authenticate and share their password hashes with him. The news of the attack was first reported by The Record.
The attack abuse the Encrypting File System Remote (EFSRPC) protocol, which is used to perform maintenance and management operations on encrypted data that is stored remotely and accessed over a network.
Lionel also published a proof-of-concept (PoC) exploit code on GitHub.
“PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function. This is possible via other protocols and functions as well 😉 .” reads the description provided by the expert.
“The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it’s more prevalent. But it’s possible to trigger with the EFSRPC named pipe and interface df1941c5-fe89-4e79-bf10-463657acf44d.”
In the PetitPotam attack demonstrated by the expert, he sent SMB requests to a remote system’s MS-EFSRPC interface and forced its system to initiate an authentication procedure and share its NTLM authentication hash.
The NTLM authentication hash can be used to carry out a relay attack or can be lately cracked to obtain the victim’s password. The PetitPotam attack can be very dangerous because it allows attackers to take over a domain controller and compromise the entire organization.
Gilles highlighted that disabling support for MS-EFSRPC did not work to mitigate this attack. At the time of this writing, there is no workaround to mitigate this issue.
Lionel told BleepingComputer, that this as a vulnerability but rather the abuse of a legitimate function.
The attack can potentially impact most of the supported Windows versions, it was successfully tested against Windows 10, Windows Server 2016, and Windows Server 2019 systems.
Mimikatz author Benjamin Delpy also successfully tested the PetitPotam attack and published a video PoC of the attack.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, windows)
[adrotate banner=”5″]
[adrotate banner=”13″]
