JuicyPotatoNG

JuicyPotatoNG revives the JuicyPotato DCOM abuse against modern Windows by using a specific CLSID and a local COM server on a non-default port to coerce a SYSTEM authentication, then impersonates the token. The -t flag selects the token API: 't' uses CreateProcessWithTokenW (needs SeImpersonatePrivilege), 'u' uses CreateProcessAsUserW (needs SeAssignPrimaryTokenPrivilege), and '*' tries both. It works on Windows 10 / Server 2019 and later where classic JuicyPotato was blocked. Requires SeImpersonate or SeAssignPrimaryToken on the service account. Command Reference: Privilege required: SeImpersonatePrivilege COM listen port: 9999

# -t * tries both token-creation APIs, -l sets the local COM server port
JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -a "/c whoami" -l 9999

Native

PrivEsc, Exploitation

Requires

Shell

Services

DCOM

Refs

github.com/antonioCoco/JuicyPotatoNG

book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/juicypotato