Token Impersonation

Every process carries an access token describing its user, groups, and privileges. Windows supports impersonation — a process can act under another user's token. Abusing this lets a service account become SYSTEM.

Two token privileges are gold for escalation: SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege. Service accounts (IIS, MSSQL) usually hold SeImpersonate, which the "Potato" family of exploits abuses.

The Potato exploits trick a SYSTEM process into authenticating to a malicious local listener, then steal/impersonate its token. Variants: JuicyPotato, RoguePotato, PrintSpoofer, GodPotato — each suits different Windows versions.

PrintSpoofer abuses the Print Spooler's named pipe to coerce SYSTEM authentication, then impersonates the token to run a command as SYSTEM. It works on modern Windows 10/Server 2019 where JuicyPotato was patched.

JuicyPotato abuses DCOM/BITS to relay SYSTEM authentication to a local listener. It is reliable on older Windows (pre-1809 / Server 2016) but was mitigated on newer builds, hence RoguePotato/PrintSpoofer.

Conceptually: you (a service account) trigger a privileged Windows component to authenticate to your malicious endpoint. You capture that authentication and, thanks to SeImpersonate, wrap the SYSTEM token around a new process — instant SYSTEM shell.

RottenPotato was the original; RoguePotato updated it to bypass the post-1809 DCOM fixes by using an OXID resolver redirect. Choosing the right Potato depends on the exact build number from systeminfo.

Beyond impersonation, watch for SeBackupPrivilege/SeRestorePrivilege (read/write any file — dump SAM), SeDebugPrivilege (inject into SYSTEM processes), and SeTakeOwnership. Each is its own escalation path.

Post-exploitation frameworks ease token abuse. Meterpreter's incognito lists and impersonates available tokens; if a SYSTEM or admin token is present in memory, you can steal it directly.

The Potato landscape is version-sensitive. Read the OS build, then pick: JuicyPotato (old), RoguePotato/PrintSpoofer (1809+), GodPotato (broad modern coverage). The right tool reliably yields SYSTEM; the wrong one simply fails.

Defenders limit which accounts get SeImpersonate, patch promptly, disable the Print Spooler where unneeded, and monitor for suspicious token use. Use these techniques only within authorized engagements.

Test your token-impersonation knowledge.

You learned token impersonation:

• Access tokens define identity; impersonation can be abused
• SeImpersonatePrivilege enables the Potato exploits
• PrintSpoofer/RoguePotato for modern Windows, JuicyPotato for old
• Other dangerous privileges: SeBackup, SeDebug, SeTakeOwnership

Next: credential harvesting.