You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.md
+96-4Lines changed: 96 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,45 @@
2
2
3
3
{{#include ../../banners/hacktricks-training.md}}
4
4
5
-
> [!WARNING] > **JuicyPotato doesn't work** on Windows Server 2019 and Windows 10 build 1809 onwards. However, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,**[**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,**[**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato)**,**[**GodPotato**](https://github.com/BeichenDream/GodPotato)**,**[**EfsPotato**](https://github.com/zcgonvh/EfsPotato)**,**[**DCOMPotato**](https://github.com/zcgonvh/DCOMPotato)** can be used to **leverage the same privileges and gain `NT AUTHORITY\SYSTEM`** level access. This [blog post](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/) goes in-depth on the `PrintSpoofer` tool, which can be used to abuse impersonation privileges on Windows 10 and Server 2019 hosts where JuicyPotato no longer works.
5
+
> [!WARNING]
6
+
> **JuicyPotato doesn't work** on Windows Server 2019 and Windows 10 build 1809 onwards. However, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,**[**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,**[**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato)**,**[**GodPotato**](https://github.com/BeichenDream/GodPotato)**,**[**EfsPotato**](https://github.com/zcgonvh/EfsPotato)**,**[**DCOMPotato**](https://github.com/zcgonvh/DCOMPotato)** can be used to **leverage the same privileges and gain `NT AUTHORITY\SYSTEM`** level access. This [blog post](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/) goes in-depth on the `PrintSpoofer` tool, which can be used to abuse impersonation privileges on Windows 10 and Server 2019 hosts where JuicyPotato no longer works.
7
+
8
+
> [!TIP]
9
+
> A modern alternative frequently maintained in 2024–2025 is SigmaPotato (a fork of GodPotato) which adds in-memory/.NET reflection usage and extended OS support. See quick usage below and the repo in References.
10
+
11
+
Related pages for background and manual techniques:
12
+
13
+
{{#ref}}
14
+
seimpersonate-from-high-to-system.md
15
+
{{#endref}}
16
+
17
+
{{#ref}}
18
+
from-high-integrity-to-system-with-name-pipes.md
19
+
{{#endref}}
20
+
21
+
{{#ref}}
22
+
privilege-escalation-abusing-tokens.md
23
+
{{#endref}}
24
+
25
+
## Requirements and common gotchas
26
+
27
+
All the following techniques rely on abusing an impersonation-capable privileged service from a context holding either of these privileges:
28
+
29
+
- SeImpersonatePrivilege (most common) or SeAssignPrimaryTokenPrivilege
30
+
- High integrity is not required if the token already has SeImpersonatePrivilege (typical for many service accounts such as IIS AppPool, MSSQL, etc.)
31
+
32
+
Check privileges quickly:
33
+
34
+
```cmd
35
+
whoami /priv | findstr /i impersonate
36
+
```
37
+
38
+
Operational notes:
39
+
40
+
- PrintSpoofer needs the Print Spooler service running and reachable over the local RPC endpoint (spoolss). In hardened environments where Spooler is disabled post-PrintNightmare, prefer RoguePotato/GodPotato/DCOMPotato/EfsPotato.
41
+
- RoguePotato requires an OXID resolver reachable on TCP/135. If egress is blocked, use a redirector/port-forwarder (see example below). Older builds needed the -f flag.
42
+
- EfsPotato/SharpEfsPotato abuse MS-EFSR; if one pipe is blocked, try alternative pipes (lsarpc, efsrpc, samr, lsass, netlogon).
43
+
- Error 0x6d3 during RpcBindingSetAuthInfo typically indicates an unknown/unsupported RPC authentication service; try a different pipe/transport or ensure the target service is running.
6
44
7
45
## Quick Demo
8
46
@@ -23,6 +61,10 @@ NULL
23
61
24
62
```
25
63
64
+
Notes:
65
+
- You can use -i to spawn an interactive process in the current console, or -c to run a one-liner.
66
+
- Requires Spooler service. If disabled, this will fail.
DCOMPotato provides two variants targeting service DCOM objects that default to RPC_C_IMP_LEVEL_IMPERSONATE. Build or use the provided binaries and run your command:
149
+
150
+
```cmd
151
+
# PrinterNotify variant
152
+
PrinterNotifyPotato.exe "cmd /c whoami"
153
+
154
+
# McpManagementService variant (Server 2022 also)
155
+
McpManagementPotato.exe "cmd /c whoami"
156
+
```
157
+
158
+
### SigmaPotato (updated GodPotato fork)
159
+
160
+
SigmaPotato adds modern niceties like in-memory execution via .NET reflection and a PowerShell reverse shell helper.
- Monitor for processes creating named pipes and immediately calling token-duplication APIs followed by CreateProcessAsUser/CreateProcessWithTokenW. Sysmon can surface useful telemetry: Event ID 1 (process creation), 17/18 (named pipe created/connected), and command lines spawning child processes as SYSTEM.
174
+
- Spooler hardening: Disabling the Print Spooler service on servers where it isn’t needed prevents PrintSpoofer-style local coercions via spoolss.
175
+
- Service account hardening: Minimize assignment of SeImpersonatePrivilege/SeAssignPrimaryTokenPrivilege to custom services. Consider running services under virtual accounts with least privileges required and isolating them with service SID and write-restricted tokens when possible.
176
+
- Network controls: Blocking outbound TCP/135 or restricting RPC endpoint mapper traffic can break RoguePotato unless an internal redirector is available.
177
+
- EDR/AV: All of these tools are widely signatured. Recompiling from source, renaming symbols/strings, or using in-memory execution can reduce detection but won’t defeat solid behavioral detections.
0 commit comments