antonioCoco/RoguePotato

Health v2 · maintenance only

Adoption not part of the score

1177 stars · 136 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RoguePotato is a Windows local privilege escalation tool written in C that elevates from a service account to SYSTEM by abusing the DCOM/NTLM relay technique. It is a successor to JuicyPotato that works on modern Windows versions by using a remote redirector and a fake Oxid Resolver.

Use cases

• escalate privileges from a Windows service account to SYSTEM
• exploit Windows local privilege escalation via NTLM relay
• run a command as SYSTEM from a restricted service account
• perform red team privilege escalation on Windows hosts
• bypass JuicyPotato limitations on modern Windows versions

When to choose

• you need SYSTEM-level code execution from a Windows service account during an authorized penetration test
• JuicyPotato fails on newer Windows builds and you need the RoguePotato technique
• you can set up a network redirector on a remote machine

When to avoid

• you are not operating in an authorized security testing context
• you need a general-purpose Windows security auditing tool rather than a specific exploit
• the target environment blocks the required RPC/redirector setup

Facets

cli-tool · maturity maintenance

security penetration-testing security penetration-testing windows windows cli privilege-escalation potato-attack ntlm-relay red-team rpc

Member repositories

For agents

markdown · JSON · MCP: product_card(name="antonioCoco/RoguePotato")