SeImpersonatePrivilege

🤷 Abusing SeImpersonate and SeAssignPrimaryToke

In Windows, every process has a token that has information about the account that is running it. These tokens are not considered secure resources, as they are just locations within memory.

To utilize the token, the SeImpersonate privilege is needed.  It is only given to administrative accounts.

We will often run into this privilege after gaining remote code execution via an application that runs in the context of a service account.

List our privileges

whoami /priv

If the command whoami /priv confirms that SeImpersonatePrivilege is listed, we may use it to impersonate a privileged account such as NT AUTHORITY\SYSTEM.

For that there are several tools such as JuicyPotato, PrintSpoofer, or RoguePotato to escalate to SYSTEM level privileges, depending on the target host.

🥔 JuicyPotato: SeImpersonate or SeAssignPrimaryToken

RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS service having the MiTM listener on 127.0.0.1:6666 and when you have SeImpersonate or SeAssignPrimaryToken privileges. During a Windows build review we found a setup where BITS was intentionally disabled and port 6666 was taken.

See more on JuicyPotato

🖨️ PrintNightmare

PrintNightmare is the nickname given to two vulnerabilities (CVE-2021-34527 and CVE-2021-1675) found in the Print Spooler service that runs on all Windows operating systems.

See more on PrintNightmare

🏊 Print Spooler / PrintSpoofer: SeImpersonatePrivilege + Windows Print Spooler service

The Print Spooler exploitation leverages the Windows Print Spooler service in conjunction with the SeImpersonatePrivilege privilege. The goal is to impersonate a SYSTEM token to escalate privileges. Tools like PrintSpoofer automate this process effectively. Below are detailed steps for exploiting this vulnerability:

See more on PrintSpoofer

Last update: 2025-04-13
Created: April 13, 2025 13:19:01