Generic impersonation and privilege escalation with Golang. Like GenericPotato both named pipes and HTTP are supported.

This is very similar to GenericPotato - I referenced it heavily while researching.

Gotato starts a named pipe or web server and waits for input. Once a client has connected Gotato will attempt to steal their token and impersonate them. Able to trick a process running as SYSTEM into interacting with the pipe or web server? You're now SYSTEM.

Same as the rest of the potato family this requires SeImpersonate.

Usage: gotato -m [http|pipe] [-p PORT] [-n PIPE_NAME]
  -h    Print this help menu
  -m string
        Mode [http|pipe] (default "pipe")
  -n string
        Pipe name (default "mal")
  -p int
        HTTP server port (default 4644)