github.comrepoCrystalPotato
CrystalPotato is a Crystal-language port of GodPotato, a Windows local privilege escalation tool that abuses the DCOM OXID Resolver and named pipe impersonation to escalate from an account with SeImpersonatePrivilege to SYSTEM. It resolves Windows APIs dynamically, invokes them via indirect syscall stubs, XOR-obfuscates strings at compile time, and can execute commands, spawn reverse shells, or create a local admin account. Compiles to a single dependency-free static binary and was tested on Windows 10, 11, and Server 2025.
TL;DR A Crystal-language GodPotato clone that escalates SeImpersonatePrivilege to SYSTEM via DCOM/named-pipe abuse, with syscall obfuscation for evasion.
Organisations named here
- DCOM OXID Resolver
- SeImpersonatePrivilege
Technologies named here
- Windows 10
- CrystalPotato
- GodPotato
- Windows 11
- Windows Server 2025
- RustPotato
- SigmaPotato
- Crystal
- Windows
Techniques named here
- Dynamic API resolution
- Indirect syscall stubs
- String obfuscation
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup