SweetPotato

SweetPotato is a C# Windows local privilege-escalation tool that combines DCOM/NTLM interception, a BITS/WinRM path, EFSRPC coercion, and PrintSpoofer named-pipe impersonation. It attempts to obtain and duplicate a privileged token, then starts a selected child program with that token. The current source proceeds when the caller's token enables SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege; the pipe-based EFSRPC and PrintSpoofer paths specifically use client-token impersonation. It requires a suitable local token and mode-specific host conditions, not an NTLM hash or remote WinRM credentials.