Skip to content

SeImpersonatePrivilege

But It's a Potato!

Remarkable explanation about the Potato world and what is going under the hood: https://jlajara.gitlab.io/Potatoes_Windows_Privesc

Hot binaries!

My potato compiled binaries: https://github.com/amandaguglieri/Privescalation/tree/main/tools/SeImpersonatePrivilege

🤷 Abusing SeImpersonate and SeAssignPrimaryToke

In Windows, every process has a token that has information about the account that is running it. These tokens are not considered secure resources, as they are just locations within memory.  To utilize the token, the SeImpersonate privilege is needed.  It is only given to administrative accounts. We will often run into this privilege after gaining remote code execution via an application that runs in the context of a service account.

List our privileges

1
whoami /priv

If the command whoami /priv confirms that SeImpersonatePrivilege is listed, we may use it to impersonate a privileged account such as NT AUTHORITY\SYSTEM.

For that there are several tools such as JuicyPotato, PrintSpoofer, Godpotato, or RoguePotato to escalate to SYSTEM level privileges, depending on the target host.

🥔 JuicyPotato: SeImpersonate or SeAssignPrimaryToken

If the machine is >= Windows 10 1809 & Windows Server 2019 - Try Rogue Potato

If the machine is < Windows 10 1809 < Windows Server 2019 - Try Juicy Potato

RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS service having the MiTM listener on 127.0.0.1:6666 and when you have SeImpersonate or SeAssignPrimaryToken privileges. During a Windows build review we found a setup where BITS was intentionally disabled and port 6666 was taken.

See more on JuicyPotato

🖨️ PrintNightmare

PrintNightmare is the nickname given to two vulnerabilities (CVE-2021-34527 and CVE-2021-1675) found in the Print Spooler service that runs on all Windows operating systems.

See more on PrintNightmare

The Print Spooler exploitation leverages the Windows Print Spooler service in conjunction with the SeImpersonatePrivilege privilege. The goal is to impersonate a SYSTEM token to escalate privileges. Tools like PrintSpoofer automate this process effectively. Below are detailed steps for exploiting this vulnerability:

See more on PrintSpoofer

🥔 GodPotato: SeImpersonate

Repo: https://github.com/BeichenDream/GodPotato

See more on godpotato

🍟 SweetPotato

Repo: https://github.com/CCob/SweetPotato/tree/master

See more on sweetpotato

Last update: 2026-03-30
Created: April 13, 2025 13:19:01