The Evolution of Potato Privilege Escalation
An overview of the history and evolution of Potato privilege-escalation techniques, from Hot Potato and Rotten Potato to JuicyPotato, PrintSpoofer, RoguePotato, and SweetPotato.
Read in Chinese→0x01 Introduction
While researching privilege escalation, I found that many related techniques have emerged recently, and I found them rather confusing myself. I therefore collected materials from the Internet to consolidate, reproduce, and organize them for everyone’s convenience.
I am still somewhat confused, so this article will probably be updated once I have a clearer understanding. Individual articles will be published later; this is the general introduction.
0x01 Historical Timeline
2016-01-16: First-Generation Potato
Hijacks WPAD and combines it with NTLM relaying to escalate privileges.
Hot Potato – Windows Privilege Escalation
2016-09-26: Second-Generation Potato
Redirects the system COM server address to a malicious server, then invokes AcceptSecurityContext during NTLM Type 3 authentication to obtain a SYSTEM token.
Rotten Potato – Privilege Escalation from Service
2018/01/13: Details of Potato Tokens
Potatoes and tokens – Decoder’s Blog
2018-08-10: Compilation of Usable CLSIDs
Juicy Potato (abusing the golden privileges) | jui…
2018/10/29: Microsoft Patched the Potato Exploit Chain
The handle can no longer be controlled during NTLM authentication.
No more rotten/juicy potato? – Decoder’s Blog
2019/03/06: Named Pipe Client Impersonation Was Discussed
Windows Named Pipes & Impersonation – Decoder’s Bl
2020/05/02: Third-Generation Potato
Currently the most powerful exploit chain, obtaining a SYSTEM token through named pipe impersonation.
PrintSpoofer - Abusing Impersonation Privileges on
2020/05/11
Hijacks the OXID Resolver and changes the address returned by ResolveOxid2 to a malicious pipe address.
No more JuicyPotato? Old story, welcome RoguePotat
2020/05/13: Potato Privilege-Escalation Collection
GitHub - CCob/SweetPotato: Local Service to SYSTEM…
Confusion About the Names
RottenPotato’s upgraded version —》 JuicyPotato
SweetPotato == a combined version of JuicyPotato/PrintSpoofer
PrintSpoofer == PipePotato == BadPotato—three names for the same thing?
The foreign researcher who first released the public PoC called it PrintSpoofer. A subsequent paper from 360 called it PipePotato, and then a PoC by a Chinese developer on GitHub called it BadPotato.