The Rise of Potatoes: Privilege Escalations in Windows Services
summary
Documents recent, concrete privilege‑escalation chains that turn service accounts into NT AUTHORITY\SYSTEM by abusing Windows service behavior and impersonation; demonstrates working proof‑of‑concept tools that steal tokens from service processes, forge RPC/activation requests over named pipe and network channels, and trigger code execution via Print Spooler. Claims apply to default Windows Server and client installs, bypass several common mitigations, enable lateral remote execution, and include live demos and released exploit tooling that successfully escalates to SYSTEM on tested configurations.
AI-written summary · about
chapters (14)
- 0:00Windows service privilege escalations
- 1:07Why Windows services are targets
- 2:33What is a Windows service
- 6:04Microsoft’s hardening efforts
- 11:44Potato techniques classification
- 12:04Forcing service behavior
- 19:14Print spooler vulnerabilities
- 21:51Critical process impersonation
- 25:27Remote service abuse risks
- 30:04Network service account trickery
- 31:29Real-world impact of flaws
- 35:04Downgrading authentication
- 38:45Live demo of attack
- 40:14Mitigations and best practices
related talks
44mwhoami priv - show me your privileges and I will lead you to SYSTEM
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
56m"Easy LPEs and Common Software Vulnerabilities"
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
58mPrivilege Escalation in Microsoft Azure
34mLPEPM - Tricking Microsoft EPM To Do Our Bidding
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field