BeichenDream/GodPotato

Health v2 · maintenance only

Adoption not part of the score

2334 stars · 273 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

GodPotato is a C# Windows privilege escalation tool that abuses a DCOM/RPCSS oxid resolution defect to elevate from a service account with ImpersonatePrivilege to NT AUTHORITY\SYSTEM. It works on Windows 8 through Windows 11 and Windows Server 2012 through 2022, executing arbitrary commands as SYSTEM.

Use cases

• escalate web shell or database service account to NT AUTHORITY\SYSTEM
• run a command as SYSTEM after gaining ImpersonatePrivilege
• spawn a reverse shell with SYSTEM privileges on modern Windows
• post-exploitation privilege escalation on Windows Server 2012-2022
• test whether a service account can be elevated via potato-style attacks

When to choose

• you have code execution as a service account with SeImpersonatePrivilege on Windows 8/2012 or newer
• older Potato variants like JuicyPotatoNG fail on the target OS version
• you need a simple command-line tool to run a command or reverse shell as SYSTEM

When to avoid

• the target account lacks ImpersonatePrivilege
• the target runs Windows Server 2008/Windows 7 or older (use JuicyPotato instead)
• you need stealth or AV evasion - it is a well-known, widely detected public exploit

Facets

cli-tool · maturity stable

security penetration-testing security penetration-testing windows windows cli privilege-escalation potato dcom rpcss system-exploit red-team impersonation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="BeichenDream/GodPotato")