Summer 2021’s escalating pattern continued: after the SAM ACL embarrassment, security researchers dropped another NTLM-relay primitive that devastated careless Active Directory environments. PetitPotam (CVE-2021-36942 for the patched variant), a coercion technique forcing any domain-joined Windows machine to authenticate to an attacker-chosen endpoint, was chained against AD CS (Active Directory Certificate Services) misconfigurations — largely the ESC8 “web enrollment over HTTP” pattern — to mint legit certificates for the domain controller machine account and then DCSync the entire domain. Impact: complete forest compromise from any foothold that could reach an EFS API and an HTTP certificate enrollment endpoint. Nothing about PetitPotam itself was exotic: it weaponised the same SMB-signing-not-required, HTTP-relay-tolerant default posture that has haunted AD shops for a decade. What changed was packaging: one public tool, one clear blog post, one afternoon from low-priv domain-user to domain admin via certificates.
PetitPotam is an NTLM coercion technique (public PoC July 2021, patched as CVE-2021-36942 in August 2021) abusing the Microsoft Encrypting File System (EFS) Remote Procedure Call protocol: any authenticated attacker (or, in some paths, even machine-context coercion) calls MS-EFSRPC APIs (e.g., EfsRpcOpenFileRaw) on a victim Windows host, forcing it to authenticate (via NTLM) to an attacker-controlled listener. Relay that authentication to an AD CS Certificate Authority’s web-enrollment endpoint (ESC8 pattern: HTTP, NTLM accepted, no HTTPS/Signer requirements) requesting a DC or domain-controller authentication certificate for e.g. the domain controller machine account, then use the minted cert with Kerberos PKINIT to authenticate as that DC and run DCSync — dumping every credential in the domain including the krbtgt hash. Variants: chained via other coercion endpoints (PrinterBug, DFSCoerce, ShadowCoerce) if a patch blocks the original EFS path. Defence: NTLM blocking/logon restrictions, SMB signing mandatory, EFS RPC protocol hardening (Microsoft’s August 2021 patch required explicit RPC connection-level authentication, killing null sessions), and above all auditing + hardening AD CS per Microsoft’s CS-security guidance (ESC1–ESC10 class misconfigurations; kill HTTP web enrollment, enable HTTPS+certificate auth to CA, enable EPA/SAN restrictions, audit enrollment rights). PetitPotam matters historically as the technique that pushed certificate-based attacks from research-novelty (Certified Pre-Owned, SpecterOps May 2021) into commodity tooling — every red team since carries a coercion+ESC8 chain, making AD CS hygiene a mandatory 2026 baseline.
What happened
Credit sequencing: SpecterOps’ “Certified Pre-Owned” (June 2021) mapped AD CS attack surfaces (ESC1–ESC8 templates and endpoint misconfigs); security researcher Gilles Lionel (topotam) then published PetitPotam (July 2021) as a novel, reliable coercion primitive — the missing trigger that made ESC8 trivially weaponisable against web enrollment. August 2021: mass exploitation reports followed (notably incidents involving Lace Tempest/METASTEAL ransomware-style operators using PetitPotam+ESC8 pre-encryption, and later widespread commodity abuse), Microsoft patched the specific EFS RPC unauthenticated-abuse vector (CVE-2021-36942) — but coercion as a class (PrinterBug, DFSCoerce, ShadowCoerce, coercer-style multi-endpoint tooling) remained alive, so the defensive lesson generalised far beyond one CVE.
The industry’s response unfolded in layers: incident-response shops added ESC8-path alerting to CA web-enrollment IIS logs; hardening guides told admins to disable the web-enrollment role outright (certutil-web enrollment end-of-life basically); Microsoft’s escalation to “certificate-based auth hardening” workstreams (later including KB5014754 enforcement phases) folded PetitPotam-era lessons into 2022–2023 controls. But in the moment — August–September 2021 — any org with a CA enrolment page on HTTP and default SMB-signing posture was one public tool away from full compromise, and many paid for it.
How it worked
The chain, end to end:
attacker (any domain auth or positioned on net):
1. coercion: call MS-EFSRPC on victim DC (EfsRpcOpenFileRaw
path EFSRPC:\\<attacker>\stub)
-> victim DC initiates NTLM auth TO attacker listener
2. relay: attacker forwards NTLM exchange (ntlmrelayx.py
-t http://CA/certsrv/certrqxt.asp --adcs --template DomainController)
to AD CS web enrollment over HTTP (ESC8: no signing req,
no channel binding, NTLM accepted)
3. mint: CA issues DC-authentication certificate mapping to
victim DC machine account
4. auth: use cert with Kerberos PKINIT (Rubeus 'asktgt /certificate'
style) -> TGT AS the domain controller
5. escalate: DCSync (mimikatz lsadump::dcsync) -> krbtgt + all
hashes -> forge golden tickets / full domain control
defensive kills (any ONE breaks the chain):
- patch EFS RPC authentication requirements (CVE-2021-36942)
- disable/HTTPS-only CA web enrollment, enforce EPA/template
sanitisation (ESC8 kill)
- require SMB signing + channel binding on relaying surfaces
- block NTLM where feasible (Kerberos-only policies)
- Protected Users / high-value account logon restrictionsThe pattern — coerce, relay, mint, escalate — became the template for a generation of AD attacks, and its countermeasures (certificate-services baselines, NTLM sunset programmes, signing enforcement) are exactly the identity-plane defences we track in identity-security coverage.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Technique name | PetitPotam (EFS RPC coercion) | topotam/Gilles Lionel PoC |
| CVE (patched vector) | CVE-2021-36942 | Microsoft Aug 2021 |
| Primary target | AD CS web enrollment (ESC8) | Certified Pre-Owned taxonomy |
| Prerequisite | Any authenticated domain context + network path | research write-ups |
| Outcome | DC cert → DCSync → domain/forest admin | chained PoCs |
| Public tooling | PetitPotam.py, ntlmrelayx, Rubeus, coercer | open source |
| Exploitation reports | Aug 2021 onward (ransomware pre-staging observed) | vendor IR telemetry |
Timeline
| Date | Event |
|---|---|
| 2021-06 | SpecterOps “Certified Pre-Owned” catalogues AD CS abuse (ESC1–ESC8) |
| 2021-07 | PetitPotam PoC published (topotam) |
| 2021-08 | Microsoft patches EFS RPC vector (CVE-2021-36942); exploitation reports climb |
| 2021–2022 | Commodity abuse in ransomware chains; coercer-style multi-vector tooling |
| 2022–2023 | KB5014754 certificate-auth hardening phases; NTLM sunset roadmaps |
Why it still matters in 2026
PetitPotam’s specific CVE is historical, but the attack class is contemporary infrastructure reality: NTLM relaying against any HTTP/RPC endpoint that accepts it without signing, channel binding, or EPA, and certificate-services misconfigs that mint powerful identities. Microsoft’s long NTLM deprecation (and 2024–2026 enforcement phases) is the ultimate fix, but until full removal, coercion endpoints keep being discovered (the DFSCoerce/ShadowCoerce lineage proves it’s a protocol-design surface, not a one-off bug), making monitoring “unexpected outbound authentications from servers” — the coercion tell — a permanent detection. On the blue side, ESC8-class hardening (no HTTP enrollment, certificate-template hygiene, enrollment-rights audits, CA role isolation) is now foundational control in maturity models, and pass-the-cert detection (PKINIT anomalies, unusual certificate issuance for machine accounts) is standard EDR/SIEM content. Every modern identity-protection programme — the discipline we cover across identity attack-surface reviews — is downstream of lessons PetitPotam made unavoidable.
Detection and hardening takeaways
- Kill ESC8 configuration. Remove/disable AD CS web enrollment over HTTP; require HTTPS with authentication hardening (EPA), and audit certificate templates for dangerous enrolment rights (ESC1–ESC7 class issues) — the mint step is where the chain pays off, so close the mint shop.
- Enforce SMB signing and channel binding everywhere. Relay chains need somewhere to land; default-not-required signing on member servers and HTTP endpoints is the standing invitation PetitPotam exploited — policy-override it domain-wide and monitor for non-compliant hosts.
- Detect coercion as anomalous outbound auth. Servers (DCs especially) spontaneously authenticating to random internal IPs is never benign — alert on it (4624 type 3 with anomalous target, workstation-source anomalies, EFSRPC call patterns), and treat it as an active-relay beacon.
- Block NTLM aggressively where possible. Kerberos-only policies for admin accounts, Protected Users group membership, and auditing NTLM usage via policy logs shrink the relay attack surface toward zero while the ecosystem completes NTLM sunset.
- Audit certificate issuance for machine accounts. Unexpected DC/server cert issuance, PKINIT TGT requests without matching enrollment events, and certificate-auth anomalies are the post-mint tells — detection content your CA logging pipeline should already own.
FAQ
Was PetitPotam a vulnerability in AD CS?
No — the elegance (and frustration) is the split: PetitPotam itself is a coercion technique against an RPC protocol behaviour; ESC8 is a misconfiguration class on certificate-services endpoints. Only chained together do they produce compromise. That’s why Microsoft patched the EFS vector as a CVE (CVE-2021-36942) but the real-world fix was configuration hardening on CAs — and why unpatched-but-hardened environments survived while patched-but-misconfigured ones still fell to variant coercion tools.
Why did certificates make it worse than password relay?
Because certificates are identity anchors that outlive authentication-policy changes: a minted DC-authentication certificate authenticates as the machine account via PKINIT, bypassing password-hash theft detection paths, and — pre-hardening — wasn’t bound tightly to issuance sanity. Certificates allow authentication “cleanly” with Kerberos, are long-lived by default, and chain to enterprise trust. MFA/pass-the-hash defences aimed at NTLM don’t touch them. That asymmetry is what made AD CS abuse the post-2021 escalation path of choice.
Is this fixed by now, in 2026?
The specific EFS coercion vector is patched and hardened against, and certificate-based-authentication hardening (mandatory EPA, template lockdowns, strong certificate-mapping enforcement) dramatically raises the bar. But the class persists wherever legacy NTLM-relayable endpoints and lenient CAs remain — which, in every large estate audit, is still somewhere. Treat “can I coerce and relay in my domain?” as a standing annual test, not a closed ticket.
