RottenPotato local privilege escalation from service account to SYSTEM
C# Other
Switch branches/tags
Nothing to show
Clone or download
Latest commit 80d7977 Dec 29, 2017
Failed to load latest commit information.
NHttp First commit Sep 23, 2016
Potato First commit Sep 23, 2016
SharpCifs First commit Sep 23, 2016 updated readme Dec 29, 2017
rottenpotato.exe First commit Sep 23, 2016

This code is no longer maintained - for a newer implementation see


Local Privilege Escalation from Windows Service Accounts to SYSTEM

For a technical overview of this exploit see our blog post at


  1. Compile.
  2. Use ILMerge to combine Potato.exe, SharpCifs.dll NHttp.dll, and Microsoft.VisualStudio.OLE.Interop.dll. This will produce a single, portable binary.
  3. Get a meterpreter shell on the target system
  4. use incognito
  5. Run the binary from step.2
  6. impersonate_token "NT AUTHORITY\SYSTEM"

It is important to impersonate the token (or run list_tokens -u) quickly after runnning the binary. With the current implementation, the token seems to disappear shortly after the binary is run. It is also important to follow the order of the steps. Make sure you "use incognito" before running the binary.

See videos at and for example.