The Privilege You Already Hold
The last three notes all made you find something: a writable service binary, a missing DLL, an unquoted path, a missing patch. This one needs nothing of the sort.
Sometimes the path to SYSTEM is already in your hands, sitting in your own token. Back in enumeration you ran whoami /priv. A single line in that output can be a one-step win.
Some Windows privileges are so powerful that holding one is the escalation. No misconfiguration, no exploit. You just use what you already have.
Dangerous Privileges
A privilege is a specific right assigned to an account, separate from file permissions. Most are mundane, changing the time zone, bypassing traverse checking. But a handful are game-over.
The ones worth recognizing instantly:
| Privilege | What it lets you do |
|---|---|
| SeImpersonatePrivilege | Impersonate another user’s token → become SYSTEM via a Potato |
| SeBackupPrivilege | Read any file, ignoring permissions → copy the SAM and dump hashes |
| SeDebugPrivilege | Read any process’s memory → Mimikatz against LSASS |
| SeLoadDriverPrivilege | Load a kernel driver → load a vulnerable one and exploit it |
| SeAssignPrimaryTokenPrivilege | Assign a token to a new process → spawn it as another user |
The one you’ll meet constantly is
SeImpersonatePrivilege, because service accounts have it by default, and you often land on a service account.
What SeImpersonate Does
Recall from enumeration that a token is your security context, the bundle Windows checks on every action. A process can run under its own primary token, or temporarily impersonate a different token, acting with someone else’s identity.
SeImpersonatePrivilege grants exactly that power, with one condition: a process holding it can impersonate the token of any user who authenticates to it.
This exists for a legitimate reason. A server often needs to do work on behalf of a client, an IIS worker, a SQL Server, an RPC service, so it impersonates the client to access resources as them. That’s why Windows assigns SeImpersonate to service accounts (IIS APPPOOL, LOCAL SERVICE, NETWORK SERVICE, SERVICE) by default.
And that’s the catch: pop a web app, and you’re frequently running as one of those accounts, holding SeImpersonate already.
The Potato Attack
If you can impersonate whoever authenticates to you, the goal writes itself: make SYSTEM authenticate to you. SYSTEM won’t do that on request, so you force it.
The mechanism is a named pipe, a local channel two processes use to talk. The crucial property: a named pipe server can impersonate whatever client connects to it. So the attack is:
- You hold
SeImpersonatePrivilege(say, as a service account) - You stand up a named pipe you control
- You coerce a SYSTEM-level service to connect and authenticate to your pipe
- SYSTEM authenticates, and you impersonate its token
- You run code as SYSTEM
Step 3 is the clever part, tricking SYSTEM into connecting, done with RPC/DCOM coercion. You don’t do it by hand: the Potato family of tools handles the whole dance.
| Tool | When you reach for it |
|---|---|
| RottenPotato | The original |
| JuicyPotato | The workhorse on older Windows |
| PrintSpoofer / RoguePotato | Newer Windows, where JuicyPotato was patched |
| GodPotato / SweetPotato / SigmaPotato | Modern, broad version support |
You point one at a command, and it runs as SYSTEM:
If
whoami /privshowsSeImpersonatePrivilege, run a Potato. It is frequently a one-step escalation to SYSTEM.
Beyond SeImpersonate
SeImpersonate is the headline, but the other dangerous privileges each have their own path up. Spot one in whoami /priv and look up its abuse:
- SeBackupPrivilege: back up the registry hives (
SAM,SYSTEM), then extract the hashes offline - SeDebugPrivilege: read LSASS memory with Mimikatz and pull credentials
- SeLoadDriverPrivilege: load a vulnerable signed driver, then exploit it
- SeAssignPrimaryTokenPrivilege: pair it with a stolen token to launch a process as that user
The habit that ties this whole module together: read
whoami /privearly. A dangerous privilege is almost always the fastest way up, quicker than hunting for a writable service or a missing patch.
Closing Windows Privilege Escalation
Across this module you climbed from an unprivileged foothold to SYSTEM five different ways:
- enumerating secrets people left behind
- hijacking a writable service binary, a searched-for DLL, or an unquoted path
- replacing a scheduled task’s program
- running an exploit
- and now abusing a privilege your token already held
They’re all one idea wearing different clothes: find something that runs with high privilege, but that you can control.
The same goal, against a completely different security model and a fresh set of vectors, waits on Linux, starting with Enumerating Linux.
Practice Boxes
- Alfred - TryHackMe. Exploit Jenkins for a shell, then token impersonation off
SeImpersonateto SYSTEM. - Grandpa - HackTheBox. IIS 6 RCE drops you on a service account with
SeImpersonate, then churrasco/JuicyPotato to SYSTEM. The classic. - Bastard - HackTheBox. Drupal RCE, then JuicyPotato off
SeImpersonateto SYSTEM. - Remote - HackTheBox. A modern take:
SeImpersonateto SYSTEM with RoguePotato.