Skip to content
This repository has been archived by the owner on Dec 6, 2023. It is now read-only.

Add necessary class for success when calling EfsRpcEncryptFileSrv from PetitPotam #549

Merged
merged 1 commit into from
Mar 6, 2022
Merged

Add necessary class for success when calling EfsRpcEncryptFileSrv from PetitPotam #549

merged 1 commit into from
Mar 6, 2022

Conversation

coffeegist
Copy link
Contributor

This PR fixes a current bug when using the PetitPotam module. Currently, when running PetitPotam via CME, if the call to EfsRpcOpenFileRaw has been patched, the following output is produced and a false negative is produced that the host is not vulnerable:

DEBUG [-] Connecting to ncacn_np:10.0.1.101[\PIPE\lsarpc]
DEBUG [+] Connected!
DEBUG [+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
DEBUG [+] Successfully bound!
DEBUG [-] Sending EfsRpcOpenFileRaw!
DEBUG [-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
DEBUG [+] OK! Using unpatched function!
DEBUG [-] Sending EfsRpcEncryptFileSrv!
DEBUG Something went wrong, check error status => 
    module 'payload_module' has no attribute 'EfsRpcEncryptFileSrvResponse'

This PR adds the necessary EfsRpcEncryptFileSrvResponse class to prevent the false negative.

@mpgn mpgn merged commit e9bcd09 into byt3bl33d3r:master Mar 6, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants