Active Directory remains the crown jewel of most enterprise networks, and attackers know it. This technical analysis covers two powerful attack techniques: NTLM relay and PetitPotam. NTLM relay tricks a server into authenticating against an attacker-controlled endpoint, while PetitPotam forces a Windows host to authenticate via MS-EFSRPC. Combined, they can lead to full domain compromise in minutes. The post provides a practical walkthrough of the attack chain, from initial foothold to privilege escalation. It also highlights common misconfigurations that make these attacks possible, such as unpatched AD CS servers and weak SMB signing policies. For defenders, the key takeaways are to enable SMB signing, disable NTLM where possible, and apply Microsoft's patches for PetitPotam. This is a must-read for anyone responsible for securing Windows networks.
A deep dive into NTLM relay and PetitPotam attacks against Active Directory, showing how attackers chain these techniques to gain domain admin. Essential reading for security teams to harden their AD environments.