Microsoft has quickly hopped on issuing a set of mitigations to neutralize a newly discovered Windows NT LAN Manager (NTLM) exploit that enables attackers to hijack Windows domain controllers and effectively take over an entire domain.
The PetitPotam attack vector is an NTLM Relay Attack that could force remote Windows systems to yield their password hashes. Microsoft said it has previously documented such attacks along with mitigation options to protect customers.
Security researcher Gilles Lionel first identified the bug and posted proof-of-concept exploit code to demonstrate the attack, reports said. Microsoft subsequently issued a security advisory that included workaround mitigations.
PetitPotam is primarily aimed at corporate networks, The Record, which first reported on the exploit, said in a blog post. “PetitPotam cannot be exploited remotely over the internet and is an attack designed to be used inside large corporate networks, where attackers could use it to force domain controllers to cough up their NTLM password hashes or authentication certificates, which could lead to the complete takeover of a company’s internal network,” the blog said.
PetitPotam takes advantage of servers where Active Directory Certificate Services (AD CS) is not configured with protections for NTLM Relay Attacks, Microsoft said. Administrators are potentially vulnerable to this attack by using AD CS with Certificate Authority Web Enrollment and Certificate Enrollment Web Service.
To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators must ensure that services that permit NTLM authentication make use of protections such as Extended Protection for Authentication (EPA) or signing features such as server message block (SMB) signing, Microsoft said in the advisory.
If potentially affected by PetitPotam, Microsoft recommends the following primary mitigations:
Additional mitigations:
