antonioCoco/RemotePotato0

Health v2 · maintenance only

Adoption not part of the score

1469 stars · 221 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RemotePotato0 is a Windows privilege escalation exploit that abuses the DCOM activation service to trigger NTLM authentication from privileged users and relay it cross-protocol (RPC to HTTP) to escalate from a generic user to Domain Admin. It also supports capturing NTLMv2 hashes of all users logged on to a target machine.

Use cases

• escalate privileges from standard user to domain admin on windows
• relay ntlm authentication to ldap to escalate a user
• capture ntlmv2 hashes of logged-on users on a machine
• perform cross-session dcom activation attacks
• set up rpc to http cross-protocol relay for ntlmrelayx
• red team active directory privilege escalation testing

When to choose

• you are on a pentest or red team engagement against an active directory environment
• a privileged user such as a domain admin is logged on the same target machine
• you need to steal ntlmv2 hashes from logged-on sessions
• you want a standalone windows executable for potato-style relay attacks

When to avoid

• you are on patched windows server 2019+ where the main rpc to ldap exploit scenario is fixed
• you need a general-purpose privilege escalation enumeration tool rather than a specific exploit
• you lack any foothold or a privileged user session on the target machine
• you are not authorized to test the target environment

Facets

cli-tool · maturity maintenance

security penetration-testing networking security penetration-testing windows windows cli privilege-escalation ntlm-relay active-directory exploit red-team hash-capture dcom

Member repositories

For agents

markdown · JSON · MCP: product_card(name="antonioCoco/RemotePotato0")