Thread by @_nwodtuhs

[thread] A lot of people since this finding are looking for a bit knowledge around that bug. Below is list of links that will help better understand this (attackers-side)

https://twitter.com/topotam77/status/1416833996923809793

PetitPotam’s MS-EFSR abuse is the equivalent (even better) of the PrinterBug’s MS-RPRN abuse that’s been here for a while now

1️⃣ PrinterBug: thehacker.recipes/active-directo…
2️⃣ PetitPotam: thehacker.recipes/active-directo…

Coercing a machine’s authentication is a technique allows for the capture or relay of that auth.

1️⃣ capture: thehacker.recipes/active-directo…
2️⃣ relay: thehacker.recipes/active-directo…

When capturing an auth, what’s captured is the NTLM ChallengeResponse. It’s derived from the LM or NT hash and with a certain complexity depending on the version of the proto that’s used (LM, LMv2, NTLM, NTLMv2, etc.).

NTLMv1 usually ~= win 🏆

github.com/NotMedic/NetNT…

Relaying an auth is another way to escalate privileges.

You could trigger a first DC’s authentication to relay it to another one for instance. With the PrinterBug or PetitPotam, the NTLM auth comes over SMB, hence limitating relay possibilites (because of signing and MIC)

But if you have DC2 not patched against CVE-2019-1040, LDAPS supported with Channel Binding not enabled, and are in control of a machine account you can: trigger DomainController1, relay to DomainController2 with
- MIC and signing flags removal
- RBCD delegation attack

You’ll allow your controlled machine account to impersonate (almost) anyone on DC1

$ ntlmrelayx -t ldaps://DC2 --escalate-user 'CNTRLED_MACHINE$' --delegate-access

Another technique: if you find a machine admin to another, you could trigger machine1´s NTLM auth and relay it to machine2 to obtain an admin SMB session. That session could be used to dump SAM and LSA secrets for instance. You’re admin to machine2 now
There is a catch though

For this to work, you need to have machine2 to not have SMB signing set to required (which is the case by default on DCs)
Try to find a « machine2 » that actually gives you more possibilities than you already have

$ ntlmrelayx -t smb://Machine2

Another technique: NTLM relay to AD CS HTTP endpoints
I haven’t RTFMed enough on this technique so here you go, @SpecterOps’s article on this

posts.specterops.io/certified-pre-…

NTLM is not available? You’ll have fun with Kerberos

The Kerberos auth has delegation features

If you have control over a machine set with Constrained or, even better, Unconstrained delegations, you’ll be able to work something out

Control over a machine with Unconstrained delegations will usually lead you to full domain compromise, PetitPotam will be of a great help now that the Spooler service is disabled in many orgz, preventing the PrinterBug from being exploited

thehacker.recipes/active-directo…