{
  "family": "juicypotato",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nJuicyPotato is a highly potent, open-source post-exploitation \"HackTool\" used to achieve Local Privilege Escalation (LPE) on Microsoft Windows operating systems. It exploits a known vulnerability in the way Windows handles DCOM (Distributed Component Object Model) authentication. When executed by an attacker who already possesses low-level access (e.g., a standard user or a compromised service account), JuicyPotato allows them to elevate their privileges to `NT AUTHORITY\\SYSTEM`, granting them absolute control over the compromised machine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nJuicyPotato is not an initial infection vector (like a trojan or worm). It is a specialized tool deployed *after* an attacker has already breached the perimeter. It is frequently utilized during penetration tests and by malicious actors following the compromise of a web server (e.g., gaining an IIS AppPool service account via a web shell).\n\nIts execution relies on exploiting the `SeImpersonatePrivilege` or `SeAssignPrimaryTokenPrivilege`:\n<ul>\n<li><strong>Rogue COM Server:</strong> The tool creates a rogue COM server and tricks a high-privileged Windows service (running as SYSTEM) into authenticating with it.</li>\n<li><strong>NTLM Reflection:</strong> It captures the NTLM authentication traffic from the SYSTEM account and reflects it back to the local machine, effectively stealing the SYSTEM token.</li>\n<li><strong>Token Impersonation:</strong> Using the `SeImpersonatePrivilege`, the attacker applies the stolen SYSTEM token to a new process (e.g., launching `cmd.exe` or a reverse shell), instantly granting them full administrative rights.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of JuicyPotato on a network is a critical incident indicating a severe escalation of an existing breach. An attacker operating as SYSTEM can disable antivirus, dump credentials from LSASS memory, install rootkits, and move laterally across the Active Directory environment without restriction.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Containment:</strong> Isolate the compromised host immediately. Because the attacker has SYSTEM privileges, they likely have deeply embedded persistence mechanisms that standard AV cannot remove.</li>\n<li><strong>Patching and Configuration:</strong> While Microsoft has patched specific DCOM vectors, the fundamental issue relies on service accounts possessing `SeImpersonatePrivilege`. Ensure servers are fully patched. More importantly, adhere to the Principle of Least Privilege: do not grant service accounts (like IIS or SQL service accounts) local administrative rights or the `SeImpersonatePrivilege` unless strictly required.</li>\n<li><strong>Complete Rebuild:</strong> The only secure remediation for a machine where an attacker has achieved SYSTEM level access is a complete bare-metal wipe and re-image from a trusted source.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.JuicyPotato",
    "Riskware.JuicyPotato",
    "Exploit.LPE.JuicyPotato"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1134.001",
    "T1068",
    "T1548.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:59:32Z",
  "type": "HackTool / Privilege Escalation",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}