Add efsr_spray module

[rtpt-romankarwacik]

Description

Since Windows 11 23H2 the EFS service is only activated on demand. One ways to activate it is to write an encrypted file to a share on the respective device. This module automates this by trying to create an encrypted file on all available shares. In practice this works for any shares where the respective user has WRITE or MODIFY permissions, so print queues can also be used for this.

Type of change

• New feature (non-breaking change which adds functionality)

Setup guide for the review

Check on a up-to-date Windows 11 that the EFS service is disabled, and use the tool:

$ nxc smb -u rtpttest -p 'test1234!' -d lab.redteam --shares -- 192.0.2.115
SMB         192.0.2.115  445    WIN11VM          [*] Windows 11 Build 22621 x64 (name:WIN11VM) (domain:lab.redteam) (signing:False) (SMBv1:False)
SMB         192.0.2.115  445    WIN11VM          [+] lab.redteam\rtpttest:test1234!
SMB         192.0.2.115  445    WIN11VM          [*] Enumerated shares
SMB         192.0.2.115  445    WIN11VM          Share           Permissions     Remark
SMB         192.0.2.115  445    WIN11VM          -----           -----------     ------
SMB         192.0.2.115  445    WIN11VM          ADMIN$                          Remote Admin
SMB         192.0.2.115  445    WIN11VM          C$                              Default share
SMB         192.0.2.115  445    WIN11VM          IPC$            READ            Remote IPC
SMB         192.0.2.115  445    WIN11VM          PDFCreator      WRITE           PDFCreator Printer
SMB         192.0.2.115  445    WIN11VM          print$          READ            Printer Drivers


$ nxc smb -u rtpttest -p 'test1234!' -d lab.redteam -M efsr_spray -- 192.0.2.115
SMB         192.0.2.115  445    WIN11VM          [*] Windows 11 Build 22621 x64 (name:WIN11VM) (domain:lab.redteam) (signing:False) (SMBv1:False)
SMB         192.0.2.115  445    WIN11VM          [+] lab.redteam\rtpttest:test1234!
EFSR_SPRAY  192.0.2.115  445    WIN11VM          Successfully activated efsrpc named pipe!

Checklist:

• I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary
• New and existing e2e tests pass locally with my changes
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[XiaoliChan]

Interesting, any references about this? this will have lots of help in coercing auth attack

[NeffIsBack]

Nice one, thanks for the PR!

[rtpt-romankarwacik]

Interesting, any references about this? this will have lots of help in coercing auth attack

You can read about it in our blog on Windows coercion:
https://blog.redteam-pentesting.de/2025/windows-coercion/

[zblurx]

Hey, thanks for the module ! Working great on WS2025, but if the server is a DC and you have high privileges account, it will write the file in the root of SYSVOL, and the file won't be deletable. Can you add a blacklist of share like SYSVOL and NETLOGON ?

[rtpt-romankarwacik]

Hey, thanks for the module ! Working great on WS2025, but if the server is a DC and you have high privileges account, it will write the file in the root of SYSVOL, and the file won't be deletable. Can you add a blacklist of share like SYSVOL and NETLOGON ?

I implemented an option to exclude shares and excluded SYSVOL by default. On NETLOGON I could delete the files afterwards, so I did not include it by default.

[zblurx]

@rtpt-romankarwacik Thank you for this. Can you also check the code review on the return statement when failing to delete file ?

EDIT : Sorry I thought I had pushed the finish review button !

[zblurx]

Thanks again for the PR !