Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
rpc2wc — PoC that triggers Windows WebClient startup through EFS RPC call chains and WNF messages, enabling red teams to explore unprivileged service-start paths. | Kitploit
Tools/GitHubGitHub/0xthirteen/rpc2wc
ExploitationPost-ExploitationPenetration TestingRed Teaming
GitHub0xthirteen/rpc2wc

rpc2wc

PoC that triggers Windows WebClient startup through EFS RPC call chains and WNF messages, enabling red teams to explore unprivileged service-start paths.

View Repository
58511 year agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

RPC to WebClient

The information for this code can be found at this blog post. Recommend reading before attempting to use anything here.

Code for triggering WebClient through an RPC call. Since it did not end up panning out the code was never very cleaned up and very much remained in a proof of concept state.

These RPC calls are capable of reaching the code path to start the service:

  • EfsRpcDuplicateEncryptionInfoFile_Downlevel -> EfsDuplicateEncryptionInfoRPCClient -> EfsDuplicateEncryptionInfoClient -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton
  • EfsRpcEncryptFileSrv_Downlevel -> EfsEncryptFileClient -> LocateAndConnectToService -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton
  • EfsRpcDecryptFileSrv_Downlevel -> EfsDecryptFileClient -> LocateAndConnectToService -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton
  • EfsRpcAddUsersToFileEx_Downlevel -> EfsAddUsersClientEx -> LocateAndConnectToService -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton
  • EfsRpcRemoveUsersFromFile_Downlevel -> EfsRemoveUsersClient -> LocateAndConnectToService -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton
  • EfsRpcQueryRecoveryAgents_Downlevel -> EfsQueryRecoveryAgentsClient -> LocateAndConnectToService -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton
  • EfsRpcQueryUsersOnFile_Downlevel -> EfsQueryUsersClient -> LocateAndConnectToService -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton
  • EfsRpcFileKeyInfo_Downlevel -> EfsFileKeyInfoClient -> LocateAndConnectToService -> EfspGetFullName -> EfspAttemptToGetWebDavPath -> WNetGetResourceInformaton

Only EfsRpcEncryptFileSrv_Downlevel exists in the repo, maybe the others will be added in the future.

WnfToWebClient is .NET code that will start the WebClient service with a WNF message. Requires NT AUTHORITY/SYSTEM privileges, so again just a proof of concept.

The RPC call and the WNF message are not really weaponizable (currently) due to the security descriptors of the ETW event consumer (UBPM) and the WNF state name.

Download Tool