Microsoft warns of credential-stealing NTLM relay attacks against Windows domain controllers

Microsoft is sounding an alert about a threat against Windows domain controllers that would allow attackers to capture NTLM (NT LAN Manager) credentials and certificates. In an advisory released last Friday, the company warned of an attack dubbed PetitPotam, which could be used against Windows domains controllers and other Windows servers.

SEE: Checklist: Securing Windows 10 systems (TechRepublic Premium)

Discovered and tested by a French researcher named Gilles Lionel (known on Twitter as @topotam), according to tech news site The Record, PetitPotam exploits a security hole in Windows through which an attacker can force a Windows server to share NTLM authentication details and certificates.

Dubbed a classic NTLM relay attack by Microsoft, the process works by abusing a Windows protocol known as MS-EFSRPC, which lets computers work with encrypted data on remote systems, The Record said.

By sending Server Message Block (SMB) requests to the MS-EFSRPC interface on a remote system, an attacker can trick the targeted server into sharing credential authentication details. From there, the attacker can trigger an NTLM relay attack to gain access to other computers on the same network.

As previously described in a Microsoft support document from 2009, NTLM relay attacks have been around for a number of years. Such attacks take advantage of the security vulnerabilities in NTLM as a method for authentication. Though Microsoft has been urging customers to jettison NTLM because of its flaws, many organizations still rely on it, if only for legacy applications, prompting the company to continue to patch each hole as it pops up.

Most versions of Windows server are affected by this flaw, including 2005, 2008, 2008 R2, 2012, 2012 R2, 2016 and 2019. In a support document, Microsoft explained that your organization is potentially vulnerable to PetitPotam if NTLM authentication is enabled on your domain and you use Active Directory Certificate Services (AD CS) with Certificate Authority Web Enrollment or Certificate Enrollment Web Service. If you fit that category, Microsoft offers a few recommendations.

The preferred solution is to disable NTLM authentication on your Windows domain, a process you can implement by following the steps described on this Microsoft network security page.

If you can’t disable NTLM on your domain due to compatibility reasons, Microsoft suggests disabling it on any AD CS Servers in your domain, which you can do through Group Policy. If necessary, you can add exceptions to this policy. Alternatively, disable NTLM for Internet Information Services (IIS) on AD CS Servers in your domain that run Certificate Authority Web Enrollment or Certificate Enrollment Web Service services.

“To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators must ensure that services that permit NTLM authentication make use of protections such as Extended Protection for Authentication (EPA) or signing features such as SMB signing,” Microsoft said. “PetitPotam takes advantage of servers where Active Directory Certificate Services is not configured with protections for NTLM Relay Attacks.”

Microsoft Weekly Newsletter

Be your company’s Microsoft insider by reading these Windows and Office tips, tricks, and cheat sheets.
Delivered Mondays and Wednesdays

Sign up today

Also see