SweetPotato
SweetPotato copied to clipboard
Added trigger for remotePotat0 exploit
I've added the possibility to trigger the NTLM authentication of a computer/user account against a remote endpoint, in order to relay the NTLM messages towards an LDAPS/LDAP endpoint on a DC and then elevate privileges. Running this attack doesn't even require to have SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege. This technique was described here: https://www.sentinelone.com/labs/relaying-potatoes-another-unexpected-privilege-escalation-vulnerability-in-windows-rpc-protocol/
A possible use case of this feature is described in this PR on the impacket library: https://github.com/SecureAuthCorp/impacket/pull/1299