tools / potato-picker

Potato Picker

You have SeImpersonate on a Windows target. Picks the potato that gets you SYSTEM, gives the exact command, pulls the CLSIDs when JuicyPotato is in play.

1. Impersonation privilege?

Check with whoami /priv. You need SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege enabled.

2. Target OS

3. .NET on the target?

Managed potatoes (GodPotato, Sigma, PrintNotify) need it. The native ones don't.

4. Print Spooler service?

5. Outbound 135/tcp to your host?

RoguePotato needs an outbound RPC path to your OXID redirector.

6. AV / EDR present?

7. Reverse shell target (optional)

Fill both and every command switches from whoami to a reverse shell.

Assumes nc.exe staged on the target, swap for your own payload.