Microsoft Windows EFSRPC NTLM Reflection Elevation of Privileg

CVE-2021-36942 (PetitPotam) abuses the MS-EFSRPC interface: an unauthenticated attacker on the network sends EfsRpcOpenFileRaw (or one of ~14 related methods) to a Windows host and coerces its machine account into NTLM-authenticating to an attacker-controlled server. The captured NTLM authentication is then relayed — classically to Active Directory Certificate Services Web Enrollment (/certsrv) — to mint a client-auth certificate as the coerced machine. If the coerced machine is a Domain Controller, the certificate is a golden ticket: it authenticates as the DC to LDAP/Kerberos, and DCSync / full domain compromise follows in minutes. Affected: all supported Windows Server versions (2008 R2 through 2022) and Windows 10/11 client SKUs prior to the August 10, 2021 rollup.

The vendor MEDIUM rating (CVSS 5.3–7.5 depending on source; Tenable plugin lists 7.5) is catastrophically miscalibrated for AD environments. Microsoft scoped the CVE narrowly to the EFSRPC coercion primitive, punting the actual damage to KB5005413 as a *configuration* issue with NTLM+ADCS. That accounting trick lets the CVSS look tame while the operational reality is unauthenticated domain takeover on any tenant that runs ADCS Web Enrollment without EPA — which was the default for years. Treat this as CRITICAL until you can prove ADCS HTTP endpoints are hardened or gone.

Why this verdict

• Role multiplier — Domain Controller + ADCS: the documented chain succeeds against any DC where the forest also runs ADCS Web Enrollment/CES without EPA. Blast radius = full domain compromise (DCSync, krbtgt theft). This is the canonical high-value-role deployment for both affected components — floor is CRITICAL.
• KEV-listed and weaponized: CISA added it November 2021; LockFile, Conti-era operators, and multiple red teams treat PetitPotam as a standard post-foothold primitive. The mitigation SLA becomes 'immediately' regardless of bucket.
• Friction is limited to intra-network position, not to the exploit itself: the only real friction is 'attacker must be on-net with SMB reach to a DC'. In a flat corporate LAN with a phished workstation, that's satisfied on day one. This friction sets the verdict *above* the floor rather than *below* it.
• Vendor CVSS accounting error: Microsoft rated only the EFSRPC coercion primitive (I:H, no A/C) and deferred the actual DA takeover to a configuration KB. The composite chain is unauthenticated → SYSTEM on the forest, which is a textbook 9.8–10.0 outcome.

Why not higher?

Not a flat 10.0 because the chain requires the attacker to already have network reach to internal SMB (assume post-initial-access) and requires ADCS Web Enrollment or a similar relay target to be present and un-EPA'd. Tenants that removed ADCS HTTP roles or enforced EPA years ago genuinely block the chain at step 3.

Why not lower?

MEDIUM is only defensible for a Windows tenant with no ADCS, no NTLM, SMB signing enforced everywhere, and channel binding enforced — a rare unicorn. For everyone else, downgrading below HIGH ignores KEV, ignores active ransomware use, and ignores that the vendor's own KB5005413 exists precisely because the CVSS undercounted the chain.

1. Enforce EPA + Require SSL on all ADCS HTTP endpoints — Per KB5005413, enable Extended Protection for Authentication on /certsrv, /certcarequest, /certfnsh.asp, CES, and NDES virtual directories, and require HTTPS. This is the single control that breaks the ADCS relay step. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
2. Disable NTLM authentication on ADCS servers — Set LmCompatibilityLevel=5 and disable NTLM inbound on the ADCS IIS site via Restrict NTLM: Incoming NTLM traffic = Deny all accounts. Forces Kerberos-only enrollment; the relay has nothing to forward. Ship inside the 3-day window.
3. Remove ADCS Web Enrollment / CES roles if unused — Most orgs use MMC-based enrollment or autoenrollment via GPO; the HTTP roles are legacy. Uninstall ADCS-Web-Enrollment and ADCS-Enroll-Web-Svc where not required. Highest-assurance mitigation.
4. Deploy the August 10, 2021 rollup (KB5005033 family) fleet-wide — The patch blocks anonymous EFSRPC binding. This is the noisgate remediation step — complete within 90 days on all Windows Server and client SKUs; prioritize DCs and ADCS hosts in the first 7 days.
5. Enforce SMB signing and LDAP channel binding / signing domain-wide — Blocks SMB→SMB and SMB→LDAP relay variants and hardens against sibling coercion CVEs (DFSCoerce, PrinterBug, ShadowCoerce). Push via GPO to all DCs and member servers.
6. Deploy Coercer or Purple Knight to inventory coercion surface — Run Coercer scan -t <host> against every DC and file server; identify which coercion methods still respond post-patch and prioritize hardening. Also verifies EPA enforcement.

Run on an auditor workstation with domain-user credentials, or locally on each Domain Controller / ADCS host as a member of the local Administrators group. Invocation: .\Check-PetitPotam.ps1 -AdcsHost adcs01.corp.local -DcHost dc01.corp.local. Reports VULNERABLE if the August 2021 rollup is missing, if ADCS Web Enrollment is present without EPA, or if EnableCertPadding/EPA registry hardening is absent.

#requires -Version 5.1
# Check-PetitPotam.ps1 — noisgate verification for CVE-2021-36942 (PetitPotam)
# Exit 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
param(
    [string]$AdcsHost = $env:COMPUTERNAME,
    [string]$DcHost   = $env:COMPUTERNAME
)
$ErrorActionPreference = 'Stop'
$vulnFindings = @()

# 1) Confirm August 2021+ rollup is installed on the DC target
try {
    $hf = Get-HotFix -ComputerName $DcHost -ErrorAction Stop |
          Where-Object { $_.InstalledOn -ge (Get-Date '2021-08-10') }
    if (-not $hf) { $vulnFindings += "$DcHost missing August 2021+ cumulative update (KB5005033 family)" }
} catch { Write-Warning "HotFix lookup failed on $DcHost : $_"; $script:unknown = $true }

# 2) Check for ADCS Web Enrollment role on the CA host
try {
    $webEnroll = Invoke-Command -ComputerName $AdcsHost -ScriptBlock {
        Get-WindowsFeature -Name ADCS-Web-Enrollment,ADCS-Enroll-Web-Svc -ErrorAction SilentlyContinue |
            Where-Object Installed
    } -ErrorAction Stop
    if ($webEnroll) {
        # 3) EPA enforcement on /certsrv — checked via IIS config
        $epa = Invoke-Command -ComputerName $AdcsHost -ScriptBlock {
            Import-Module WebAdministration -ErrorAction SilentlyContinue
            (Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/Default Web Site/CertSrv' `
                -Filter 'system.webServer/security/authentication/windowsAuthentication' `
                -Name 'extendedProtection.tokenChecking' -ErrorAction SilentlyContinue).Value
        } -ErrorAction SilentlyContinue
        if ($epa -notin @('Require','Accept')) {
            $vulnFindings += "$AdcsHost has ADCS Web Enrollment installed WITHOUT EPA (tokenChecking=$epa)"
        }

        # 4) Verify HTTPS-only
        $httpBinding = Invoke-Command -ComputerName $AdcsHost -ScriptBlock {
            (Get-WebBinding -Name 'Default Web Site' -Protocol 'http')
        } -ErrorAction SilentlyContinue
        if ($httpBinding) { $vulnFindings += "$AdcsHost /certsrv accepts plaintext HTTP — relay possible" }
    }
} catch { Write-Warning "ADCS inspection failed on $AdcsHost : $_"; $script:unknown = $true }

# 5) NTLM restriction sanity check on the CA
try {
    $lmCompat = Invoke-Command -ComputerName $AdcsHost -ScriptBlock {
        (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name LmCompatibilityLevel -ErrorAction SilentlyContinue).LmCompatibilityLevel
    } -ErrorAction SilentlyContinue
    if ($null -ne $lmCompat -and $lmCompat -lt 5) {
        $vulnFindings += "$AdcsHost LmCompatibilityLevel=$lmCompat (should be 5 or NTLM disabled)"
    }
} catch { $script:unknown = $true }

if ($vulnFindings.Count -gt 0) {
    Write-Host 'VULNERABLE' -ForegroundColor Red
    $vulnFindings | ForEach-Object { Write-Host "  - $_" }
    exit 1
} elseif ($unknown) {
    Write-Host 'UNKNOWN — one or more remote checks failed; re-run with elevated creds' -ForegroundColor Yellow
    exit 2
} else {
    Write-Host 'PATCHED' -ForegroundColor Green
    exit 0
}

Sources

1. Tenable Plugin 152102
2. MSRC CVE-2021-36942
3. Microsoft KB5005413 — Mitigating NTLM Relay Attacks on AD CS
4. CERT/CC VU#405600
5. Rapid7 — PetitPotam Attack Chain
6. topotam/PetitPotam PoC
7. p0dalirius/Coercer — multi-vector coercion tool
8. Splunk PetitPotam Analytic Story