Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
HighCISA KEVExploited in the wildPublic exploit

PetitPotam / Windows LSA Spoofing Vulnerability

IdentifiersCVE-2021-36942CWE-290Also known aspetitpotam

CVE-2021-36942 is the Windows Local Security Authority (LSA) spoofing vulnerability commonly referred to as PetitPotam. It is associated with abuse of the MS-EFSRPC interface, especially functions such as EfsRpcOpenFileRaw, to coerce a Windows host, including domain controllers, into authenticating to an attacker-controlled system. The provided content indicates that PetitPotam forces outbound authentication by supplying attacker-controlled UNC paths through EFSRPC methods. Microsoft’s KB5005033 update blocked some unauthenticated PetitPotam paths, specifically unauthenticated EFSRPC calls exposed via \pipe\lsarpc, but the content states that authenticated coercion via EFSRPC, including access through \pipe\efsrpc, continued to work in some environments. The issue is widely used as an authentication-coercion primitive rather than a standalone end goal and is commonly chained with NTLM relay, particularly against AD CS enrollment endpoints.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can coerce high-value Windows systems, including domain controllers and other Tier 0 assets, to authenticate to attacker-controlled infrastructure. This can expose NTLM authentication material for relay or abuse in follow-on attacks. The content specifically ties exploitation to credential theft, unauthorized access, privilege escalation, lateral movement, certificate issuance via AD CS relay, attempted DCSync, and potential full domain compromise. It is also described as ransomware-relevant and included in CISA KEV with ransomware-related context.

Mitigation

If you can’t patch tonight, do this now.

Mitigations described in the content include enabling SMB signing, enabling Extended Protection for Authentication, restricting or disabling NTLM where feasible, applying RPC filtering, disabling unnecessary RPC services, hardening AD CS, and disabling HTTP-based AD CS enrollment where possible. Additional mitigation from the content includes monitoring for anomalous RPC usage and uncommon coercion-capable interfaces, and enabling detections such as Windows Event ID 5145 for suspicious lsarpc share access and Event ID 4768 for suspicious certificate-based Kerberos TGT requests. Because authenticated coercion may remain possible after patching, defensive controls against NTLM relay are critical.

Remediation

Patch, then assume compromise.

Apply Microsoft security updates addressing CVE-2021-36942, including KB5005033 or later cumulative updates, to block the known unauthenticated PetitPotam vectors. Because the provided content states that patching only partially addressed the issue and that authenticated EFSRPC coercion may still be possible in some environments, remediation should also include hardening dependent relay targets and authentication paths, especially AD CS web or RPC enrollment endpoints. Where possible, remove or harden AD CS HTTP enrollment, enable Extended Protection for Authentication, and reduce reliance on NTLM.
PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app
CVE-2026-24294MaturityPoCVerified exploit

Repository contains a working exploit chain combining a modified Windows PetitPotam coercion client with a modified Impacket SMB server. The purpose is local NTLM reflection / privilege escalation on Windows Server 2025 by abusing SMB arbitrary-port connections plus SMB session multiplexing. The C++ project under PetitPotam/ is a Visual Studio solution that binds to the EFSRPC interface UUID df1941c5-fe89-4e79-bf10-463657acf44d over the named pipe \\pipe\\efsrpc using ncacn_np. It accepts three arguments: capture server, target server, and EFS API selector. It constructs a UNC path to \\<captureServer>\test\topotam.exe and invokes one of several EFSRPC methods (notably EfsRpcEncryptFileSrv in the README example) against the target. Success is inferred from expected RPC error codes such as ERROR_BAD_NETPATH or ERROR_ACCESS_DENIED, indicating the target attempted outbound access to the attacker-controlled UNC path. The generated files ms-efsrpc_c.c, ms-efsrpc_h.h, ms-dtyp.h, and ms-dtyp_h.h are MIDL-generated RPC client stubs and type definitions supporting the EFSRPC calls. They are not standalone exploit logic but provide the RPC interface implementation used by PetitPotam.cpp. The Python smbserver.py is a modified Impacket SMB server entry point. It adds a -relay-port option and hooks SMB2 SESSION_SETUP handling to capture a second NTLM authentication on an already-established multiplexed SMB connection, then forwards that authentication to a raw relay listener such as ntlmrelayx --raw-port. This turns the coerced authentication into a usable relay/reflection primitive. The README documents the full three-terminal workflow: start ntlmrelayx on raw port 6666 targeting smb://127.0.0.1, start smbserver.py on TCP 12345 with share name test and relay-port 6666, then mount \\127.0.0.1\test using /tcpport:12345 and run PetitPotam.exe 127.0.0.1 localhost 2. Expected outcome is command execution as NT AUTHORITY\SYSTEM. Overall, this is a real exploit repository, not merely detection code. It is operational rather than heavily weaponized: the coercion path/share is partly hardcoded, the workflow is manual, and it relies on external tooling (Impacket ntlmrelayx) for final command execution.

0xNDIDisclosed Apr 30, 2026cppclocalnetworkweb
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Microsoft CorporationWindows Server 2004operating_system
Microsoft CorporationWindows Server 2008operating_system
Microsoft CorporationWindows Server 2008 R2operating_system
Microsoft CorporationWindows Server 2008 Sp2operating_system
Microsoft CorporationWindows Server 2012operating_system
Microsoft CorporationWindows Server 2012 R2operating_system
Microsoft CorporationWindows Server 2016operating_system
Microsoft CorporationWindows Server 2019operating_system
Microsoft CorporationWindows Server 20h2operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware6

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.