[German]Security researchers recently disclosed a new attack vector called PetitPotam. Using an NTLM relay attack, any Windows domain controller can be taken over by attackers. Now, ACROS Security has presented a free 0Patch solution for various Windows Server versions that prevents exploitation of the vulnerability.
The PetitPotam vulnerability
Frensh security researcher Gilles Lionel (alias Topotam) had published a proof of concept (PoC) in July 2021 for exploiting an NTLM relay attack that can take over Windows domain controllers. There is a method to force a domain controller to authenticate to a malicious NTLM relay. This allows then to forward the request over HTTP to a domain's Active Directory certificate services. Ultimately, the attacker obtains a Kerberos ticket (TGT) that could be used to assume the identity of any device on the network, including a domain controller.
I had reported on this scenario in the blog post PetitPotam attack allows Windows domain takeover. There is now a workaround available from Microsoft (see Microsoft Delivers Workaround for Windows PetitPotam NTLM Relay Attacks) and an approach to block the attacks via Netsh filter (see PetitPotam attacks on Windows blocked by RPC filters). A new way to block the vulnerability has now come to my attention from ACROS Security.
The 0Patch fix for PetitPotam
The team at ACROS Security, which has been providing the 0Patch solution for years, has analyzed the PetitPotam vulnerability and quickly developed a micropatch to render the vulnerability harmless. Mitja Kolsek brought this free solution to my attention via Twitter.
Detaisls are described in this blog post from 0patch. The 0patch micropatches are available for free for the following products:
- Windows Server 2019 (updated with July 2021 Updates)
- Windows Server 2016 (updated with July 2021 Updates)
- Windows Server 2012 R2 (updated with July 2021 Updates)
- Windows Server 2008 R2 (updated with January 2020 Updates, no Extended Security Updates)
Notes on how the 0patch agent works, which loads the micropatches into memory at the runtime of an application, can be found in the blog posts (such as here).
Similar articles:
PetitPotam attack allows Windows domain takeover
Microsoft's mitigations of Windows PetitPotam NTLM relay attacks
Microsoft Security Update Revisions (July 29, 2021)
PetitPotam attacks on Windows blocked by RPC filters
0patch: Fix for Internet Explorer 0-day vulnerability CVE-2020-0674
0patch: Fix for Windows Installer flaw CVE-2020-0683
0patch fix for Windows GDI+ vulnerability CVE-2020-0881
0-day vulnerability in Windows Adobe Type Library
0patch fixes CVE-2020-0687 in Windows 7/Server 2008 R2
0patch fixes CVE-2020-1048 in Windows 7/Server 2008 R2
0patch fixes CVE-2020-1015 in Windows 7/Server 2008 R2
0patch for 0-day RCE vulnerability in Zoom for Windows
Windows Server 2008 R2: 0patch fixes SIGRed vulnerability
0patch fixes CVE-2020-1113 in Windows 7/Server 2008 R2
0patch fixes CVE-2020-1337 in Windows 7/Server 2008 R2
0patch fixes CVE-2020-1530 in Windows 7/Server 2008 R2
0patch fixes Zerologon (CVE-2020-1472) vulnerability in Windows Server 2008 R2
0patch fixes CVE-2020-1062 in Windows 7/Server 2008 R2
0patch fixes CVE-2020-1300 in Windows 7/Server 2008 R2
0patch fixes 0-day vulnerability in Windows 7/Server 2008 R2
0patch fixes CVE-2020-1013 in Windows 7/Server 2008 R2
0patch fixes a Local Privilege Escalation 0-day in Sysinternals PsExec
0patch fixes Windows Installer 0-day Local Privilege Escalation vulnerability
0patch fixes 0-day in Internet Explorer
0patch fixes CVE-2021-26877 in the DNS server of Windows Server 2008 R2
0patch fixes Windows Installer LPE-Bug (CVE-2021-26415)
0Patch provides support for Windows 10 version 1809 after EOL
Windows 10 V180x: 0Patch fixes IE vulnerability CVE-2021-31959
0Patch Micropatches for PrintNightmare Vulnerability (CVE-2021-34527)
0patch fix for new Windows PrintNightmare 0-day vulnerability (Aug. 5, 2021)
