topotam/PetitPotam

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2267 stars · 303 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PetitPotam is a proof-of-concept tool that coerces Windows hosts to authenticate to attacker-controlled machines via the MS-EFSRPC protocol (EfsRpcOpenFileRaw and related functions). It is written in C with a Python variant using Impacket, and can trigger authentication without credentials against Domain Controllers.

Use cases

• coerce NTLM authentication from Windows hosts during penetration tests
• test domain controllers for CVE-2021-36942 exposure
• relay coerced authentication to escalate privileges in Active Directory
• demonstrate MS-EFSRPC abuse in security assessments
• verify whether EFS service disabling mitigates coercion attacks

When to choose

• you are a pentester testing NTLM relay or AD certificate escalation paths
• you need a credential-free coercion primitive against domain controllers
• you want a lightweight PoC to validate MS-EFSRPC patch status

When to avoid

• you need a maintained, feature-rich exploitation framework rather than a PoC
• your use case is defensive monitoring rather than attack simulation
• you require a licensed or supported tool for production environments

Facets

cli-tool · maturity maintenance

security penetration-testing networking security penetration-testing windows windows python cli ntlm-coercion ms-efsrpc ad-security poc cve-2021-36942 impacket

Member repositories

For agents

markdown · JSON · MCP: product_card(name="topotam/PetitPotam")