EnableAllTokenPrivs & TcbElevation

A Windows token carries privileges that may be enabled or disabled. EnableAllTokenPrivs attempts to enable privileges already present; it cannot invent a missing one. TcbElevation is a separate proof of concept for an identity possessing SeTcbPrivilege. The supplied report illustrates this workflow.

Inspect before and after

whoami /user
whoami /priv
. .\EnableAllTokenPrivs.ps1
whoami /priv

Review the script before loading it. Check that SeTcbPrivilege is actually present, and run the check in the token context the script changed. Enabling that bit alone does not make whoami report SYSTEM.

Separate helper from proof

In an isolated compatible Windows lab, compile/review the matching TcbElevation source. Its interface takes a unique test identifier and an executable path:

.\TcbElevation-x64.exe lab-proof-01 'C:\Lab\IdentityProof.exe'

Use a reviewed proof executable that writes its process identity to a local file and exits. Do not substitute an arbitrary downloaded binary. The technique can create privileged system artefacts; inspect the implementation, record changes and remove them after testing. Architecture, token state and OS behaviour affect compatibility.

Success: the newly launched proof process reports its elevated identity. Neither a disabled privilege nor an error from a service action establishes success by itself. Restrict SeTcbPrivilege to system components that need it. See Potato attacks for the different SeImpersonate family.

Token state is local to a process or thread

State	Meaning	Next step
Privilege absent	Not assigned to this token	Enabling cannot add it
Privilege present, disabled	Assigned but not active	Enable in the relevant process context
Privilege enabled	Available to checks that require it	Still need a compatible operation/PoC
Impersonation token active	Thread can differ from process identity	Determine which token the helper actually opens

whoami /priv is useful, but an independently started process can have a different token from the thread performing a privileged operation. The helper source opens the current PowerShell process token. Keep before/after checks and the child proof within that same session.

Review and measure the helper

Get-FileHash .\EnableAllTokenPrivs.ps1 -Algorithm SHA256
Select-String -Path .\EnableAllTokenPrivs.ps1 -Pattern 'OpenProcessToken|AdjustTokenPrivileges'
whoami /user
whoami /priv
. .\EnableAllTokenPrivs.ps1
whoami /user
whoami /priv

Enabling privileges should not change the account SID. A successful API return can still be accompanied by ERROR_NOT_ALL_ASSIGNED; Microsoft’s API documentation explains why the requested privilege must already be assigned.

Confirm platform and binary provenance

[Environment]::Is64BitOperatingSystem
[Environment]::Is64BitProcess
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber
Get-FileHash .\TcbElevation-x64.exe -Algorithm SHA256

Use a build matching the intended architecture. Compile from the reviewed source when possible. A similarly named executable from another repository can have a different interface or leave different artefacts.

Make the launched identity the observable result

The existing two-argument example expects an executable path, not a PowerShell command string. Build a short lab proof that writes hostname, account SID and UTC timestamp to a known local file and exits. Record its own digest and expected output path before passing it to TcbElevation.

# After the reviewed proof has been launched
Get-Content 'C:\Lab\identity-proof.txt'
Get-Item 'C:\Lab\identity-proof.txt' | Select-Object FullName,CreationTimeUtc,LastWriteTimeUtc

An old proof file can create a false positive. Use a unique output name for each run, and check the new timestamp and expected marker.

Failure diagnosis and cleanup

Observation	Check
SeTcbPrivilege absent	Account rights assignment and actual token context
Remains disabled	Helper return/error details and the process it adjusted
Helper runs, identity unchanged	Expected; privilege adjustment is separate from elevation
PoC cannot start executable	Absolute path, architecture, quoting and access
PoC returns but marker is missing	Child creation result and compatible OS behaviour

Inspect the reviewed source for named objects and other changes, then remove only test-created artefacts. A fresh logon is required after some account-right assignments change; modifying the current token cannot replace that logon. Relate SeTcb to its actual API path, and use the privilege matrix for different token privileges.

How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.