discovered 24 Aug 2026
CrystalPotato
→ View on GitHubCrystalPotato is a privilege escalation tool designed for Windows, enabling users with `SeImpersonatePrivilege` to elevate their permissions to SYSTEM level. It leverages DCOM OXID Resolver and named pipe impersonation techniques, dynamically resolving Windows APIs and allowing for the execution of commands, reverse shells, or local admin user creation. Notable features include XOR-obfuscated strings, command output by default, and a compiled single-file executable with no dependencies.