When PetitPotam is exploited and NTLM credentials are relayed to Active Directory Certificate Services, an attacker can obtain Domain Administrator privileges without any prior authentication to the domain.
- THIS PROOF OF CONCEPT IS FOR EDUCATIONAL/AWARENESS/RESEARCH PURPOSES ONLY -
Read the full blogpost here:
https://blog.truesec.com/2021/08/02/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory
By Ben Bidmead @TRUESEC