Remove 2028 Remove Backups Remove DNS
article thumbnail

The Renaissance of NTLM Relay Attacks: Everything You Need to Know

Security Boulevard

PetitPotam abuses several functions in the Encrypting File System (EFS) service, such as EfsRpcOpenFileRaw, which opens a file in an arbitrary path for backup/restore. But how can we get DNS resolution for our attacker-controlled host?