A researcher found a flaw in Windows OS, tracked as PetitPotam, that can be exploited to force remote Windows machines to share their password hashes.

Security researcher Gilles Lionel (aka Topotam) has discovered a vulnerability in the Windows operating system that allows an attacker to force remote Windows machines to authenticate and share their password hashes with him. The news of the attack was first reported by The Record.

The attack abuse the Encrypting File System Remote (EFSRPC) protocol, which is used to perform maintenance and management operations on encrypted data that is stored remotely and accessed over a network.

Lionel also published a proof-of-concept (PoC) exploit code on GitHub.

“PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function. This is possible via other protocols and functions as well .” reads the description provided by the expert.

“The tools use the LSARPC named pipe with inteface c681d488-d850-11d0-8c52-00c04fd90f7e because it’s more prevalent. But it’s possible to trigger with the EFSRPC named pipe and interface df1941c5-fe89-4e79-bf10-463657acf44d.”

In the PetitPotam attack demonstrated by the expert, he sent SMB requests to a remote system’s MS-EFSRPC interface and forced its system to initiate an authentication procedure and share its NTLM authentication hash.

The NTLM authentication hash can be used to carry out a relay attack or can be lately cracked to obtain the victim’s password. The PetitPotam attack can be very dangerous because it allows attackers to take over a domain controller and compromise the entire organization.

Hi all,MS-RPRN to coerce machine authentication is great but the service is often disabled nowadays by admins on most orgz.Here is one another way we use to elicit machine account auth via MS-EFSRPC. Enjoy!! https://t.co/AGiS4f6yt8— topotam (@topotam77) July 18, 2021Gilles highlighted that disabling support for MS-EFSRPC did not work to mitigate this attack. At the time of this writing, there is no workaround to mitigate this issue.

Lionel told BleepingComputer, that this as a vulnerability but rather the abuse of a legitimate function. 

The attack can potentially impact most of the supported Windows versions, it was successfully tested against Windows 10, Windows Server 2016, and Windows Server 2019 systems.

Mimikatz author Benjamin Delpy also successfully tested the PetitPotam attack and published a video PoC of the attack.

It’s time to play with #mimikatz& #kekeo& #impacketIf you have a Windows PKI with its WebServer, you’ll have problemsNo authentication/credential to *full domain owned*> https://t.co/Wzb5GAfWfd> https://t.co/x3n9B8HHGT@topotam77 EFS & PetitPotam@ExAndroidDev PR pic.twitter.com/Z2qn1NM9zx— Benjamin Delpy (@gentilkiwi) July 23, 2021

Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, windows)

The post Obtaining password hashes of Windows systems with PetitPotam attack appeared first on Security Affairs.