Run a batch file as SYSTEM — useful for chaining into a reverse shell one-liner.
Tips & Tricks
Requires the current account to hold SeImpersonatePrivilege (whoami /priv) — this is the case for most IIS app pool identities and service accounts by default.
Works by abusing the DCOM/RPC activation flow to coerce a SYSTEM-authenticated connection back to a local named pipe, then impersonating the resulting token — no dependency on a specific leaked handle, unlike some older Potato variants.
Newer, generally unpatched alternative to JuicyPotato/JuicyPotatoNG/RoguePotato when those fail on recent Windows builds (e.g. Server 2019+).