windows-token-privilege-escalation

name	windows-token-privilege-escalation
description	Windows privilege escalation using token abuse techniques. Use this skill whenever the user mentions Windows privilege escalation, token privileges, Se* privileges, or needs to escalate from a lower-privileged user to SYSTEM/Administrator. Trigger for any Windows security assessment, penetration testing, or red team engagement where token-based privilege escalation is relevant.

Windows Token Privilege Escalation

A comprehensive guide to escalating privileges on Windows systems by abusing token privileges.

Quick Start

1. Check available privileges: whoami /priv
2. Enable disabled tokens: Use EnableAllTokenPrivs.ps1
3. Identify exploitable privileges from the table below
4. Execute the appropriate technique for your privilege

Checking Privileges

whoami /priv

Note: Both Enabled and Disabled tokens can be abused. Disabled tokens can be enabled.

Enable All Token Privileges

# Download and run
.\EnableAllTokenPrivs.ps1
whoami /priv

Or use the embedded script from Lee Holmes' post.

Token Privilege Exploitation

SeImpersonatePrivilege

Allows impersonation of any token if a handle can be obtained. Exploit by inducing a Windows service (DCOM) to perform NTLM authentication against an exploit.

Tools:

• JuicyPotato
• RogueWinRM (requires WinRM disabled)
• SweetPotato
• PrintSpoofer

Impact: SYSTEM privileges

SeAssignPrimaryPrivilege

Similar to SeImpersonatePrivilege. Allows assigning a primary token to a new/suspended process.

Method:

1. Acquire privileged impersonation token
2. Derive primary token using DuplicateTokenEx
3. Create new process with CreateProcessAsUser or set token on suspended process

Impact: SYSTEM privileges

SeTcbPrivilege

Allows using KERB_S4U_LOGON to get impersonation tokens for any user without credentials.

Capabilities:

• Get impersonation token for any user
• Add arbitrary groups (e.g., Administrators) to token
• Set token integrity level to "medium"
• Assign token to current thread via SetThreadToken

Impact: SYSTEM/Administrator privileges

SeBackupPrivilege

Grants read access to any file, useful for reading password hashes from registry.

Exploitation:

# Read password hashes from registry
# Then use Pass-the-Hash with psexec or wmiexec

Tools:

• Acl-FullControl.ps1
• SeBackupPrivilegeCmdLets

Limitations:

• Fails if Local Administrator account is disabled
• Fails if policy removes admin rights from remote Local Administrators

Impact: Read sensitive files, credential theft

SeRestorePrivilege

Grants write access to any system file regardless of ACL.

Exploitation:

• Modify services
• DLL Hijacking
• Set debuggers via Image File Execution Options
• Replace system binaries (e.g., utilman.exe)

Impact: SYSTEM/Administrator privileges

SeCreateTokenPrivilege

Powerful privilege for token impersonation, even without SeImpersonatePrivilege.

Conditions:

• Target token must belong to same user
• Target token integrity level ≤ current process integrity level

Capabilities:

• Create impersonation tokens
• Add privileged group SIDs to tokens

Impact: SYSTEM/Administrator privileges

SeLoadDriverPrivilege

Allows loading/unloading device drivers via registry entries.

Registry Path:

\Registry\User\<RID>\System\CurrentControlSet\Services\DriverName

Required Values:

• ImagePath: Path to binary to execute
• Type: SERVICE_KERNEL_DRIVER (0x00000001)

Exploitation:

1. Load buggy kernel driver (e.g., szkg64.sys - CVE-2018-15732)
2. Exploit driver vulnerability
3. Or unload security drivers: fltMC sysmondrv

Impact: SYSTEM privileges

SeTakeOwnershipPrivilege

Allows assuming ownership of objects, bypassing DACL requirements.

Exploitation:

takeown /f 'C:\some\file.txt'
icacls 'C:\some\file.txt' /grant <your_username>:F

Target Files:

%WINDIR%\repair\sam
%WINDIR%\repair\system
%WINDIR%\repair\software
%WINDIR%\repair\security
%WINDIR%\system32\config\security.sav
%WINDIR%\system32\config\software.sav
%WINDIR%\system32\config\system.sav
%WINDIR%\system32\config\SecEvent.Evt
%WINDIR%\system32\config\default.sav
c:\inetpub\wwwwroot\web.config

Impact: SYSTEM/Administrator privileges

SeDebugPrivilege

Permits debugging other processes, including memory read/write.

Dump LSASS Memory

# Using ProcDump from SysInternals
procdump -ma lsass.exe lsass.dmp

# Load in Mimikatz
mimikatz.exe
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

Get NT SYSTEM Shell

Tools:

• SeDebugPrivilege-Exploit (C++)
• SeDebugPrivilegePoC (C#)
• psgetsys.ps1

# Using psgetsys
import-module psgetsys.ps1
[MyProcess]::CreateProcessFromParent(<system_pid>,<command_to_execute>)

Impact: SYSTEM privileges, credential theft

SeManageVolumePrivilege

Allows opening raw volume device handles for direct disk I/O, bypassing NTFS ACLs.

Exploitation:

• Copy bytes of any file by reading underlying blocks
• Exfiltrate machine private keys from %ProgramData%\Microsoft\Crypto\
• Read registry hives, SAM/NTDS via VSS
• On CA servers: Exfiltrate CA private key → Golden Certificate

Impact: Arbitrary file read, credential theft, certificate forgery

Privilege Summary Table

Privilege	Impact	Tool Type	Key Technique
SeAssignPrimaryToken	Admin	3rd party	Potato tools (juicy, rotten)
SeBackup	Threat	Built-in	robocopy /b for sensitive files
SeCreateToken	Admin	3rd party	NtCreateToken for arbitrary tokens
SeDebug	Admin	PowerShell	Duplicate LSASS token, memory dump
SeLoadDriver	Admin	3rd party	Load buggy driver (szkg64.sys)
SeRestore	Admin	PowerShell	Replace utilman.exe with cmd.exe
SeTakeOwnership	Admin	Built-in	takeown + icacls
SeTcb	Admin	3rd party	Token manipulation

References

• Priv2Admin Token Table
• Token Privilege Escalation Paper
• Microsoft: SeManageVolumePrivilege
• 0xdf: HTB Certificate (SeManageVolumePrivilege)

Workflow

1. Enumerate: Run whoami /priv to see available privileges
2. Enable: If tokens are disabled, run EnableAllTokenPrivs.ps1
3. Match: Find your privilege in the table above
4. Execute: Use the recommended tool/technique
5. Verify: Confirm privilege escalation with whoami

Important Notes

• Some techniques may be detected by AV software
• Always have an exit strategy before modifying system files
• Document your findings for reporting
• Ensure you have proper authorization before testing