Add getsystem technique 6 Named Pipe Impersonation (Efs variant - AKA EfsPotato)

Author: cdelafuente-r7

lib/rex/post/meterpreter/extensions/priv/priv.rb

@@ -30,7 +30,8 @@ def self.extension_id
     named_pipe_2: 2,
     token_dup: 3,
     named_pipe_rpcss: 4,
-    named_pipe_print_spooler: 5
+    named_pipe_print_spooler: 5,
+    named_pipe_efs: 6
   }.freeze
 
   #

lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb

@@ -24,6 +24,7 @@ class Console::CommandDispatcher::Priv::Elevate
   ELEVATE_TECHNIQUE_SERVICE_TOKENDUP        = 3
   ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE_RPCSS = 4
   ELEVATE_TECHNIQUE_NAMEDPIPE_PRINTSPOOLER  = 5
+  ELEVATE_TECHNIQUE_NAMEDPIPE_EFS           = 6
 
   ELEVATE_TECHNIQUE_DESCRIPTION =
     [
@@ -32,7 +33,8 @@ class Console::CommandDispatcher::Priv::Elevate
       'Named Pipe Impersonation (Dropper/Admin)',
       'Token Duplication (In Memory/Admin)',
       'Named Pipe Impersonation (RPCSS variant)',
-      'Named Pipe Impersonation (PrintSpooler variant)'
+      'Named Pipe Impersonation (PrintSpooler variant)',
+      'Named Pipe Impersonation (EFSRPC variant - AKA EfsPotato)'
     ]
 
   #

modules/post/windows/escalate/getsystem.rb

@@ -33,7 +33,7 @@ def initialize(info = {})
     )
 
     register_options([
-      OptInt.new('TECHNIQUE', [false, "Specify a particular technique to use (1-5), otherwise try them all", 0])
+      OptInt.new('TECHNIQUE', [false, "Specify a particular technique to use (1-6), otherwise try them all", 0])
     ])
   end