From 1c38ed77130e65c8bbfd46baf80c6e87a75ae371 Mon Sep 17 00:00:00 2001 From: achakour Date: Wed, 2 Oct 2024 12:52:57 +0100 Subject: [PATCH] hello --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 6b5f5f5..04ebc7f 100755 --- a/README.md +++ b/README.md @@ -1,6 +1,7 @@ # Juicy Potato (abusing the golden privileges) *A sugared version of [RottenPotatoNG][1], with a bit of juice, i.e. **another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM*** + ## Summary [RottenPotatoNG][1] and its [variants][6] leverages the privilege escalation chain based on [`BITS`][3] [service](https://github.com/breenmachine/RottenPotatoNG/blob/4eefb0dd89decb9763f2bf52c7a067440a9ec1f0/RottenPotatoEXE/MSFRottenPotato/MSFRottenPotato.cpp#L126 ) having the MiTM listener on `127.0.0.1:6666` and when you have `SeImpersonate` or `SeAssignPrimaryToken` privileges. During a Windows build review we found a setup where `BITS` was intentionally disabled and port `6666` was taken.