DeadPotato: A Windows privilege escalation utility
DeadPotato
DeadPotato is a Windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the original GodPotato source code by BeichenDream.
Available Modules
- – cmd: Execute a command as NT AUTHORITY\SYSTEM.
- – rev: Attempts to establish a reverse shell connection to the provided host
- – exe: Execute a program with NT AUTHORITY\SYSTEM privileges (Does not support interactivity).
- – newadmin: Create a new administrator user on the local system.
- – shell: Manages to achieve a semi-interactive shell (NOTE: Very bad OpSec!)
- – mimi: Attempts to dump SAM/LSA/SECRETS with Mimikatz. (NOTE: This will write mimikatz to disk!)
- – defender: Either enables or disables Windows Defender’s real-time protection.
- – sharphound: Attempts to collect domain data for BloodHound.
Use
The SeImpersonatePrivilege right is enabled in your context? With DeadPotato, it is possible to achieve maximum privileges on the local system.
The tool will attempt to start an elevated process running in the context of the NT AUTHORITY\SYSTEM user by abusing the DCOM’s RPCSS flaw in handling OXIDs, allowing unrestricted access over the machine for critical operations to be freely performed.
⚠️ In the following case, the -cmd module is used. Many modules are available for use, such as the -rev IP:PORT for spawning an elevated reverse shell, -newadmin usr:pass for creating a new local Administrator user for persistence, or -mimi sam for dumping SAM hashes.
Verify SeImpersonatePrivilege rights
In order to use DeadPotato, the SeImpersonatePrivilege right must be enabled in the current context. In order to verify this, the whoami /priv command can be executed. If there privilege is disabled, exploitation is not possible in the current context.
