Elevation-BOF

Elevation-BOF provides multiple techniques for escalating privileges on Windows systems. From obtaining SYSTEM tokens to UAC bypass and Potato-style attacks for service accounts.

Compatible agents: Beacon, Gopher, Kharon | Platform: Windows

getsystem#

Escalates privileges to SYSTEM via token impersonation.

getsystem token#

Creates a SYSTEM token and impersonates it in the agent’s context. All subsequent commands will run as NT AUTHORITY\SYSTEM.

getsystem token

No additional arguments required. Requires the agent to be running with local administrator privileges.

Examples:

# Escalate to SYSTEM
getsystem token

# Verify the new context
whoami

Requirements:

• The agent must be running as a local administrator.
• Does not require explicit SeImpersonatePrivilege (obtained from admin context).

Use cases:

• After gaining access as a local administrator, escalate to SYSTEM for operations requiring the highest privilege level.
• Before dumping credentials with hashdump, lsadump_sam, or dcsync.
• To access protected system resources (SAM, SECURITY, locked files).

Note: On successful execution, the agent automatically enables token impersonation. All following commands will run as SYSTEM without any additional actions.

uacbypass#

Techniques to bypass Windows User Account Control (UAC) without requiring administrator privileges.

uacbypass sspi#

Bypasses UAC by exploiting SSPI (Security Support Provider Interface) authentication to obtain an elevated session.

uacbypass sspi

No arguments required. Works with users who belong to the Administrators group but are limited by UAC.

Examples:

# Bypass UAC with SSPI
uacbypass sspi

uacbypass regshellcmd#

Bypasses UAC by hijacking shell commands in the HKCU registry to achieve elevated execution.

uacbypass regshellcmd

Modifies keys in HKEY_CURRENT_USER to redirect execution of auto-elevated programs to the operator’s payload.

Examples:

# Bypass UAC with registry hijacking
uacbypass regshellcmd

Use cases for both techniques:

• The agent runs as a user who belongs to the Administrators group, but UAC blocks operations requiring elevation.
• No access to admin credentials for elevated runas.
• Need to execute privileged operations without showing the UAC prompt to the user.

Technique selection:

Recommendation: Try sspi first as it is less intrusive. If it fails, use regshellcmd.

potato-dcom#

Potato-style attack that abuses DCOM activation to escalate privileges to SYSTEM. Works with accounts that have the SeImpersonatePrivilege.

potato-dcom --token
potato-dcom --run <command>

*Use either --token OR --run, not both.

Examples:

# Get SYSTEM token via DCOM potato
potato-dcom --token

# Execute a command as SYSTEM
potato-dcom --run "net user backdoor P@ssw0rd123 /add"

# Execute a command to add user to administrators
potato-dcom --run "net localgroup Administrators backdoor /add"

Requirements:

• SeImpersonatePrivilege (common in: IIS AppPool, SQL Server, Windows services, Network Service).
• Verify with: privcheck tokenpriv (SAL-BOF).

Use cases:

• The agent runs as a service account (IIS, SQL Server, MSSQL) that has SeImpersonatePrivilege but is not an administrator.
• Initial access through a web vulnerability in IIS granting execution as IIS APPPOOL\DefaultAppPool.
• Compromised service running as NT AUTHORITY\NETWORK SERVICE.

Note: When using --token, the agent auto-enables impersonation. Subsequent commands will run as SYSTEM.

potato-print#

Potato-style attack that abuses the Print Spooler service to escalate privileges to SYSTEM. Similar to potato-dcom but uses a different vector.

potato-print --token
potato-print --run <command>

*Use either --token OR --run, not both.

Examples:

# Get SYSTEM token via Print Spooler potato
potato-print --token

# Execute a command as SYSTEM
potato-print --run "whoami"

Requirements:

• SeImpersonatePrivilege.
• The Print Spooler service must be running (enabled by default on most Windows systems).

Use cases:

• Alternative to potato-dcom when DCOM is blocked or not working.
• Environments where the Print Spooler service is available (which is most of them).
• Same service account scenarios as potato-dcom.

Technique selection guide#

Recommended workflow#

1. Check your current privileges: whoami (built-in) and privcheck tokenpriv (SAL-BOF).
2. If local admin → getsystem token.
3. If normal user in Admins group → uacbypass sspi or uacbypass regshellcmd.
4. If you have SeImpersonatePrivilege → potato-dcom --token or potato-print --token.
5. Verify escalation with whoami.
6. Proceed with privileged operations (credential dumping, SAM access, etc.).