Skip to content

PetitPotam (NTLM Coercion via EFSRPC)

PetitPotam - Github

What it is

Forces a target (often a Domain Controller) to authenticate to an attacker-controlled host via NTLM.

Why it matters

  • Enables NTLM relay
  • Common path to AD CS abuse
  • Can lead to Domain Admin under the right conditions

Requirements

  • Network access to target
  • NTLM enabled
  • Relay target available (e.g., AD CS, SMB, LDAP)

Attack Flow

  1. Trigger EFSRPC call
  2. Target initiates NTLM auth
  3. Relay authentication
  4. Gain elevated access

Detection / Artifacts

  • EFSRPC traffic
  • Unusual NTLM auth attempts
  • PrinterBug
  • DFSCoerce
  • ShadowCoerce