{
	"id": "74895ed9-7eba-406f-85c7-bddf68a72e32",
	"created_at": "2026-04-06T00:21:48.656498Z",
	"updated_at": "2026-04-10T13:11:45.132053Z",
	"deleted_at": null,
	"sha1_hash": "1a30f49ea27791b282f38c754d853a8c55d82b0e",
	"title": "GitHub - antonioCoco/JuicyPotatoNG: Another Windows Local Privilege Escalation from Service Account to System",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 36200,
	"plain_text": "GitHub - antonioCoco/JuicyPotatoNG: Another Windows Local\r\nPrivilege Escalation from Service Account to System\r\nBy antonioCoco\r\nArchived: 2026-04-05 21:16:21 UTC\r\n JuicyPotatoNG\r\n by decoder_it \u0026 splinter_code\r\nMandatory args:\r\n-t createprocess call: \u003ct\u003e CreateProcessWithTokenW, \u003cu\u003e CreateProcessAsUser, \u003c*\u003e try both\r\n-p \u003cprogram\u003e: program to launch\r\nOptional args:\r\n-l \u003cport\u003e: COM server listen port (Default 10247)\r\n-a \u003cargument\u003e: command line argument to pass to program (default NULL)\r\n-c \u003cCLSID\u003e: (Default {854A20FB-2D44-457D-992F-EF13785D2B51})\r\n-i : Interactive Console (valid only with CreateProcessAsUser)\r\nAdditional modes:\r\n-b : Bruteforce all CLSIDs. !ALERT: USE ONLY FOR TESTING. About 1000 processes will be spawned!\r\n-s : Seek for a suitable COM port not filtered by the Windows firewall\r\nSource: https://github.com/antonioCoco/JuicyPotatoNG\r\nhttps://github.com/antonioCoco/JuicyPotatoNG\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://github.com/antonioCoco/JuicyPotatoNG"
	],
	"report_names": [
		"JuicyPotatoNG"
	],
	"threat_actors": [],
	"ts_created_at": 1775434908,
	"ts_updated_at": 1775826705,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1a30f49ea27791b282f38c754d853a8c55d82b0e.pdf",
		"text": "https://archive.orkl.eu/1a30f49ea27791b282f38c754d853a8c55d82b0e.txt",
		"img": "https://archive.orkl.eu/1a30f49ea27791b282f38c754d853a8c55d82b0e.jpg"
	}
}