A critical Windows zero-day vulnerability known as “RemotePotato0”, has received an unofficial patch to protect vulnerable systems susceptible to attack. The flaw was identified in April 2021 by Sentinel LABS researcher Antonio Cocomazzi and independent researcher Andrea Pierini, however Microsoft marked it as “won’t fix,” so there is no trackable CVE ID at this time. The vulnerability is exploited via a NT LAN Manager (NTLM) relay attack. NTLM is a challenge-response protocol used for authentication in Windows. The successful exploitation of this flaw allows attackers to place themselves between targeted clients and servers so that they can relay validated authentication requests to whatever IP address they choose, in order to access different network services in an attempt to escalate their privileges within the network. Exploitation of this vulnerability could allow an attacker to make themselves the domain administrator, ideally allowing for a full domain takeover. Opatch co-founder Mitja Kolsek stated in a blog post, “It allows a logged-in low-privileged attacker to launch one of several special-purpose applications in the session of any other user who is also currently logged in to the same computer, and make that application send said user’s NTLM hash to an IP address chosen by the attacker.” To mitigate this vulnerability up until now, Microsoft recommended that Windows administrators either disable NTLM completely (replaced by Kerberos), or configure their servers to block against NTLM relay attacks via Active Directory Certificate Services (AD CS).The unofficial patch released by Opatch is free until Microsoft releases an official Windows update that fixes the vulnerability, and the Ankura CTIX recommends any Windows and Windows Server administrators to either ensure they have configured against NTLM relay attacks, or download the unofficial Opatch.