## Intro

This module utilizes the Net-NTLMv2 reflection between DCOM/RPC to achieve a SYSTEM handle for elevation of privilege. It needs a CLSID to function, a list of which can be found here: https://github.com/ohpe/juicy-potato/blob/master/CLSID/README.md

From https://github.com/ohpe/juicy-potato:

> RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS service having the MiTM listener on 127.0.0.1:6666 and when you have SeImpersonate or SeAssignPrimaryToken privileges. During a Windows build review we found a setup where BITS was intentionally disabled and port 6666 was taken.
> We decided to weaponize RottenPotatoNG: Say hello to Juicy Potato.

For more info see:
- [Rotten Potato](https://github.com/foxglovesec/RottenPotato)
- [Lonely Potato](https://decoder.cloud/2017/12/23/the-lonely-potato/)
- [Juicy Potato](https://ohpe.it/juicy-potato/)

## Usage

The session you wish to escalate must already have the SeImpersonate privilege.

![image](https://user-images.githubusercontent.com/984628/51068493-2b6ef500-161f-11e9-9287-1eac0f942f87.png)

## Scenarios:

Example with BITS CLSID (NT AUTHORITY\SYSTEM):

![image](https://user-images.githubusercontent.com/984628/50982077-aa1f4180-14fc-11e9-94f4-1a50ce765e0f.png)

Example with UPNP CLSID (NT AUTHORITY\LOCAL SERVICE):

![image](https://user-images.githubusercontent.com/984628/50982170-d76bef80-14fc-11e9-9124-ab43d69cb15c.png)
