> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/potato-attacks.md).

# Potato Attacks

{% embed url="<https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/>" %}

{% embed url="<https://github.com/ohpe/juicy-potato>" %}

<figure><img src="/files/UotDdgERKJPkVxX86QUO" alt=""><figcaption></figcaption></figure>

We can get a meterpreter session if we have access to powershell/ cmd.

<figure><img src="/files/Y8c4RO1GoaaZZ4GBDEFb" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/hqEPbgzfXOH0vWdmljDB" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/CH5iTrk2AeLUemoFah7u" alt=""><figcaption></figcaption></figure>