CoercedPotato automates local privilege escalation from LOCAL SERVICE or NETWORK SERVICE to SYSTEM on Windows by abusing SeImpersonatePrivilege through coerced RPC calls, for use in authorized assessments.
| Tool | Prepouce/CoercedPotato — automated Windows local privilege escalation tool abusing SeImpersonatePrivilege via MS-RPRN and MS-EFSR coercion |
| Category | Windows local privilege escalation (C, MIT-licensed) |
| Primary Use | Escalating from LOCAL SERVICE/NETWORK SERVICE contexts holding SeImpersonatePrivilege to SYSTEM during authorized penetration tests, using -c to run a chosen program elevated |
| Safe Use | Educational and documentary analysis for authorized professionals; run only in lab environments or engagements with explicit written authorization on systems you own or control |
| Telemetry Note | Its use generates distinctive MS-EFSR (EfsRpc*) and MS-RPRN printer-notification RPC traffic originating from the local host, which defenders can correlate with event logging on coercible RPC interfaces |
CoercedPotato is a Windows local privilege escalation tool by Prepouce (with credit to @Hack0ura) that carries a low-privileged LOCAL SERVICE or NETWORK SERVICE context all the way to SYSTEM. It belongs to the long lineage of "potato" exploits, but its distinguishing twist is the coercion vector: rather than relying on a classic relay setup, it abuses SeImpersonatePrivilege or SeImpersonatePrimaryToken by triggering vulnerable RPC methods locally and harvesting the resulting privileged token. The README states support for Windows 10, Windows 11, and Server 2022, which makes it a contemporary reference point in the potato family. The project links a companion write-up on the author's blog at blog.hackvens.fr for readers who want the underlying mechanics explained in depth.
The tool is written in C, ships as CoercedPotato.exe, and is MIT-licensed with a modest but real community footprint of roughly 400 stars on GitHub at the time of this analysis. That combination — a compiled single binary, permissive license, and active authorship — positions it as a practical instrument rather than a proof-of-concept sketch. The help banner describes it precisely as "an automated tool for privilege escalation exploit using SeImpersonatePrivilege or SeImpersonatePrimaryToken," which is a fair one-line summary of the entire potato genre. Notably, the automation is the selling point: the operator does not have to assemble the coercion, capture, and impersonation steps by hand.
Mechanically, the tool exposes two coercible RPC interfaces via the -i/--interface flag: ms-rprn and ms-efsr. MS-RPRN is the print system remote protocol, and the tool implements two trigger functions there: RpcRemoteFindFirstPrinterChangeNotificationEx() and RpcRemoteFindFirstPrinterChangeNotification(). These are the same methods made infamous by the PrintSpoofer-era research, where a coerced authentication callback from a high-privileged service can be captured and replayed. MS-EFSR, the Encrypting File System remote protocol, offers a far larger menu — the help text enumerates fourteen EfsRpc* methods, from EfsRpcOpenFileRaw() through EfsRpcQueryProtectors(), reflecting how broadly that interface exposes coercible primitives.
The -n/--exploitId flag lets the operator select a specific method index once an interface is chosen, which is useful for tuning the attempt against a particular patch level or hardening configuration. Two of the EfsRpc entries are explicitly marked # NOT WORKING — EfsRpcFileKeyInfo() and EfsRpcFileKeyEx() — and their inclusion is honest engineering documentation rather than filler. It also signals that the enumeration is exhaustive by design: the author swept the interface's method table and recorded results rather than cherry-picking only the successes. If no interface is specified, the tool defaults to trying ALL, iterating across methods until one succeeds.
Default behavior is controlled by two more flags worth understanding. --interactive (default true) decides whether the spawned program runs inside the same console or opens a new window, which matters for opsec clarity in a lab and for post-exploitation ergonomics in an engagement. -f/--force forces all RPC functions to be attempted even after the tool reports Exploit worked!, which is essentially a fuzz-adjacent mode for verifying robustness of the escalation path or diagnosing why a particular host behaves differently. Together these flags reveal a tool designed for repeatable experimentation, not just one-shot use.
The invocation surface is deliberately minimal. The README shows the canonical quick proof: ./CoercedPotato.exe -c whoami, which simply executes whoami as SYSTEM to confirm the escalation worked. A second example spawns cmd.exe with ./CoercedPotato.exe -c cmd.exe for an interactive shell in the same console. That is the entire documented usage; there are no modules, listeners, or staging features, keeping the tool squarely in the privilege-escalation niche. We deliberately avoid presenting any fuller operational chain here, since this writeup is documentary analysis of a public tool, not an exploitation guide.
What the README reveals architecturally is a single-binary pipeline: enumerate the caller's privileges, coerce a privileged service into an authentication event over the selected RPC interface, intercept the resulting token, and use the impersonation rights to launch the -c command as SYSTEM. The per-method exploitId granularity suggests each coercion primitive is implemented as its own routine rather than a generic dispatch, which explains the per-function working/not-working annotations. The C implementation keeps the footprint small and avoids runtime dependencies, a practical choice for a tool intended to run on hardened hosts where larger frameworks may not survive transplant.
For defenders, CoercedPotato is a useful mental model of why SeImpersonatePrivilege in service accounts is functionally equivalent to administrative access on modern Windows. The defensive posture is well understood: restrict and monitor the MS-EFSR and MS-RPRN endpoints, disable or firewall the Print Spooler where it is not needed, and treat service accounts holding impersonation privileges as high-value assets in threat modeling. Coercion attempts against EfsRpc methods generate observable RPC activity that endpoint telemetry can capture, and the tool's noisy default behavior — trying all methods until success — produces multiple failed calls before a hit in many configurations, which is a detection signal in its own right.
In an authorized workflow, the tool's natural home is the post-exploitation phase of a penetration test or a red-team lab exercise, specifically the moment an operator has landed as a service account and needs to demonstrate impact by reaching SYSTEM. It is equally valuable in reverse: blue teams replicating potato-class escalations in a lab can use it to validate that privilege removal, RPC firewall rules, or spooler hardening actually break the chain. That dual utility is the strongest argument for studying its interface enumerations carefully.
Caveats are worth stating plainly. The README is short, offers no build instructions beyond the binary, and provides no discussion of detection evasion or stability across patch levels — unsurprising for a focused C project, but it means operators should validate behavior in a snapshot lab first. The two # NOT WORKING methods also hint that Microsoft hardening has partially caught up with the EfsRpc surface, so expecting per-host variance is reasonable. As always with potato-class tooling, the governing constraint is authorization: this is an analysis of publicly documented functionality, and any use outside systems you own or are contractually permitted to test is out of scope.
Prepouce/CoercedPotato.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.