SeCreateTokenPrivilege
Ctrl+F:
SeCreateTokenPrivilege· create token · SYSTEM
Why: Create a token with any privileges and groups — effectively forge SYSTEM or Domain Admin identity. ⭐⭐⭐⭐⭐ impact but almost never assigned to normal users on OSCP.
whoami /priv
REM SeCreateTokenPrivilege Enabled→ Windows Privileges - OSCP Priority Hub
📌 If you see it — treat as instant win
Rare lab misconfig. Abuse paths:
- Mimikatz — token creation / impersonation primitives
- PowerUp / custom PS —
DuplicateToken/CreateProcessWithToken - Invoke-TokenManipulation (PowerSploit family)
# Research / tool-dependent — WinPEAS may suggest script
. .\PowerUp.ps1
Get-ProcessTokenPrivilege📌 vs SeImpersonate
| Privilege | Capability |
|---|---|
| SeImpersonate | Impersonate existing token (Potato tricks SYSTEM to connect) |
| SeCreateToken | Create new token from scratch — no coercion needed |
📌 Enum
whoami /priv
whoami /allWinPEAS → Privileges Information section.
📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'→ Linux > 📌 1) Basic Manual Enumeration