PE-GOD
GodPotato
Local privilege-escalation tool that turns SeImpersonatePrivilege into SYSTEM across most modern Windows versions.
OVERVIEW
GodPotato is the latest in the "potato" line of local privilege-escalation tools (following RottenPotato, JuicyPotato, PrintSpoofer, and others). It abuses the DCOM/OXID resolver mechanism to coerce a privileged RPC connection back to a listener it controls, then impersonates the resulting token — all it needs is an account that already holds SeImpersonatePrivilege, common on service accounts.
Its main advantage over older potato variants is coverage: it works across a wide span of Windows versions, from Server 2012 through Windows 11 and Server 2022, including builds where the Print Spooler-based technique used by PrintSpoofer has been mitigated.
USE CASES
Practical use cases
- 01
Escalating a service account with SeImpersonatePrivilege to SYSTEM when PrintSpoofer's Print Spooler dependency isn't available.
- 02
Confirming SeImpersonatePrivilege abuse across a broad range of Windows Server and desktop builds in a single engagement.
- 03
Chaining with a web shell or service exploit that lands as a low-privileged service account.
- 04
Demonstrating impact when a client's hardening only addressed older, well-known potato techniques.
QUICK START
On a Windows host where the current account holds SeImpersonatePrivilege and earlier potato techniques are patched, to escalate to SYSTEM across a broad range of Windows versions.
- Confirm the current account holds SeImpersonatePrivilege (whoami /priv).
- Verify local privilege-escalation testing is authorized on this host.
- Run GodPotato with a command to execute as SYSTEM.
- Confirm the resulting process token is NT AUTHORITY\SYSTEM before continuing.
GodPotato.exe -cmd "cmd /c whoami"BEFORE YOU RUN IT
What to check before running it
Public builds of GodPotato are widely signatured by AV/EDR; document detection expectations with the client before using it unmodified.
It still requires SeImpersonatePrivilege on the current account — it doesn't grant that privilege by itself.
Successful execution proves real impact from an excessive impersonation privilege: report it even when the client considers the account low-value.