Microsoft completed a vulnerability hat-trick this month as yet another security weakness was uncovered in its operating systems. And this one doesn’t even need authentication to work its magic.<\/p>\n
The security shortcoming can be exploited using the wonderfully named PetitPotam<\/a> technique. It involves abusing Redmond’s MS-EFSRPC<\/a> (Encrypting File System Remote Protocol) to take over a corporate Windows network. It seems ideal for penetration testers, and miscreants who have gained a foothold in a Windows network.<\/p>\n Specifically, security researcher Gilles Lionel found it was possible to use MS-EFSRPC force a device, including Windows domain controllers, to authenticate with a remote attacker-controlled NTLM relay. The end result<\/a> is an authentication certificate that grants the attacker domain-controller-level access to services, allowing them to commandeer the entire domain.<\/p>\n