MS-EFSR abuse (PetitPotam)
Last updated
Was this helpful?
Last updated
Was this helpful?
MS-EFSR is Microsoft's Encrypting File System Remote protocol. It performs maintenance and management operations on encrypted data that is stored remotely and accessed over a network () and is available as an RPC interface. That interface is available through the \pipe\efsrpc, \pipe\lsarpc, \pipe\samr, \pipe\lsass and \pipe\netlogon SMB named pipes.
In 2019, Google's Project Zero research team found and reported a bug on MS-EFSR that could be combined with a leading to a Local Privilege Elevation. An insufficient path check in MS-EFSR's EfsRpcOpenFileRaw method allowed attackers to force the SYSTEM account into creating an executable file of the attacker's choosing, hence providing the attacker with local admin rights.
While the wider implications of this bug, AD-DS-wise, were only suspected, in 2021, used that bug to remotely coerce domain-joined machine's authentication. The coerced authentications are made over SMB. But MS-EFSR abuse can be combined with to elicit incoming authentications made over HTTP which heightens capabilities.
The following MS-EFSR's methods were detected vulnerable
EfsRpcOpenFileRaw and EfsRpcEncryptFileSrv ()
EfsRpcEncryptFileSrv, EfsRpcDecryptFileSrv, EfsRpcQueryUsersOnFile, EfsRpcQueryRecoveryAgents, EfsRpcRemoveUsersFromFile, EfsRpcAddUsersToFile, EfsRpcFileKeyInfo, EfsRpcDuplicateEncryptionInfoFile, EfsRpcAddUsersToFileEx (unpatched at the time of this article update, 29th December 2021)
An authentication can be forced with the original author's proof-of-concepts dubbed "" (available in C and Python) by using a valid AD account's credentials.
An alternative Python implementation () can be used to exploit other unpatched methods that the original implementation doesn't feature.
Some tests conducted in lab environments showed that, unlike the , a NULL session could potentially be used to trigger that bug (if allowed by the target). This has only been verified to be working on on Windows Server 2016 and Windows Server 2019 Domain Controllers.
For the proof of concept to work, using a proper security provider (RPC_C_AUTHN_WINNT) and authentication level (RPC_C_AUTHN_LEVEL_PKT_PRIVACY) can be required, especially if the target is patched against MS-EFSR abuse (which doesn't completely mitigate the vulnerability). In both tools mentioned above, this is enabled by default only on topotam's one.
