Haiyahhh Hack Vault

Potato Attack

2 min read

🧠 Potato Attack

What is it?

  • Concept: A family of local Windows privilege escalation techniques (RottenPotato → JuicyPotato → JuicyPotatoNG → PrintSpoofer → GodPotato, roughly in chronological order) that all abuse an account holding SeImpersonatePrivilege to coerce a NT AUTHORITY\SYSTEM-authenticated connection, then steal and impersonate the resulting token.
  • Impact: Local privilege escalation from a service/IIS app-pool account straight to NT AUTHORITY\SYSTEM — this is not specific to domain-joined machines, it works identically on a standalone Windows box.

How it works

SeImpersonatePrivilege lets a process impersonate the security context of any token it can get its hands on, but it doesn’t by itself hand over a SYSTEM token. Every Potato variant works around this by tricking a SYSTEM-level component (historically the COM BITS/RPC activation service; more recently the print spooler or DCOM activation in general) into authenticating to a listener the attacker controls — usually a local named pipe or RPC endpoint. Once that SYSTEM-authenticated connection lands, the attacker’s process impersonates it and now runs as SYSTEM. The different variants mostly differ in which Windows service they coerce and how (a leaked file descriptor, a specific COM CLSID, spoofing the print spooler’s RPC calls), which is exactly why some get patched while others keep working.

Exploitation

Prerequisites

  • Code execution as an account with SeImpersonatePrivilege enabled — check with whoami /priv

Attack Vectors

# Confirm the privilege is present
whoami /priv
 
# Check the OS build, since different variants are patched on different builds
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
 
# Run whichever variant isn't patched on this build
GodPotato-NET4.exe -cmd "cmd.exe /c whoami"

Notes

  • If the newest variant (GodPotato) fails, it’s worth trying older ones too (JuicyPotatoNG, PrintSpoofer) — patch coverage isn’t always consistent across every variant on every build, and an older technique occasionally still works where a newer one doesn’t (or vice versa).
  • This privilege shows up constantly on IIS application pool identities and SQL Server service accounts by default — landing a shell as either of those is very often a straight line to SYSTEM via this technique alone.

Mitigation

  • Fix: Don’t grant SeImpersonatePrivilege to service accounts that don’t strictly need it; keep systems patched, since most individual Potato variants do eventually get closed off by Microsoft.
FileCreated
HTB - ScrambledMonday, July 20th 2026, 11:37:01 pm

References:

Graph View

Backlinks