Build your own potato - an exploration of how Windows authentication abuse "actually works"
Building a Potato exploit from scratch explains why these privilege escalation techniques keep working despite years of Microsoft patching.
Session Details
Upon compromising a Windows host, many pentesters and adversaries reach for a "Potato" tool, such as GodPotato, to escalate privileges and obtain system-level access. These pre-baked privilege escalations abuse Windows features such as Impersonation, DCOM, and NTLM authentication under the hood. But have you ever wondered how these tools actually work, and why they remain prevalent despite Microsoft's best efforts to patch them?
This presentation is not simply "this is how to build a Potato replica". It is the story of my own journey of trying to understand not only the how, but also the why, behind Potato exploits. Why do people use these specific techniques when exploiting a Potato? And why are there so many of them?
In this talk Daniel digs into the details and explains how he made his own "Potato" tool for educational purposes, and how you can do it too.
There's More Where This Came From
Browse hundreds of sessions and build an agenda around the topics that matter to you.
