-
Notifications
You must be signed in to change notification settings - Fork 51
Description
I just ran into a problem when running this poc:
Setup:
Domain joined machines (same user sessions)
Attacker = Windows Server 2022
Victim = Windows 11 pro
File successfully written to \192.168.72.130\c$\windows\temp\pwned.dll
[+] DLL dropped successfully!
[+] Attempting COM hijack on 192.168.72.130 for user HERMAN\hermans
[+] Remote Registry service enabled and started successfully!
[+] Target user COM Hijack is set!
[-] CoCreateInstanceEx failed with HRESULT: 0x80040155
[-] Error while calling remote COM object:
System.Runtime.InteropServices.COMException (0x80040155): [-] CoCreateInstanceEx failed
at BitlockMove.Server.Execute(String targetIP, String path, String username, String password, String domain) in C:\Users\hermans\Documents\BitlockMove\BitlockMove\Program.cs:line 388
[+] Target user COM Hijack is removed!
[+] Remote Registry service stopped successfully!
[+] Remote Registry service disabled successfully!
[+] File \192.168.72.130\c$\windows\temp\pwned.dll successfully deleted.
Bitlocker is active on the victim
any ideas? Thank you!