0PricingLogin▼
Ethical Hacking Academy · Lesson

Token Impersonation

Abuse privileges.

Windows Access Tokens

Every process carries an access token describing its user, groups, and privileges. Windows supports impersonation — a process can act under another user's token. Abusing this lets a service account become SYSTEM.

Impersonation Privileges

Two token privileges are gold for escalation: SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege. Service accounts (IIS, MSSQL) usually hold SeImpersonate, which the "Potato" family of exploits abuses.

whoami /priv
# SeImpersonatePrivilege  Enabled

All lessons in this course

  1. Windows Enumeration
  2. Service Misconfigurations
  3. Token Impersonation
  4. Credential Harvesting
← Back to Ethical Hacking Academy