Windows Privileges — OSCP Priority Hub
Ctrl+F:
whoami /priv· SeImpersonate · SeBackup · SeDebug · stars · Potato
After any Windows shell:
whoami /priv
whoami /allUse this table to pick the fastest privesc path — highest stars first.
→ Windows PrivEsc · Privesc Tools · Potato Attacks
📌 Priority table (OSCP)
| Privilege | Priority | Exploit / action |
|---|---|---|
| SeImpersonatePrivilege | ⭐⭐⭐⭐⭐ | Potato Attacks — GodPotato, PrintSpoofer, RoguePotato, JuicyPotato (OS-dependent) |
| SeCreateTokenPrivilege | ⭐⭐⭐⭐⭐ | Create any token — very rare; instant win if enabled |
| SeAssignPrimaryTokenPrivilege | ⭐⭐⭐⭐☆ | Same family as SeImpersonate — Potato Attacks |
| SeBackupPrivilege | ⭐⭐⭐⭐☆ | Read SAM/SYSTEM/NTDS — reg save, robocopy /b, diskshadow, nxc |
| SeRestorePrivilege | ⭐⭐⭐⭐☆ | Write/replace protected files — wbadmin recovery, service overwrite |
| SeDebugPrivilege | ⭐⭐⭐⭐☆ | Mimikatz / LSASS — privilege::debug, token theft |
| SeTakeOwnershipPrivilege | ⭐⭐⭐☆☆ | takeown + icacls → read SAM, replace binaries |
| SeLoadDriverPrivilege | ⭐⭐⭐☆☆ | Load vulnerable driver — rare on OSCP |
| SeManageVolumePrivilege | ⭐⭐⭐☆☆ | SeManageVolumeExploit → DLL Injection |
📌 Quick decision flow
whoami /priv
│
├─ SeImpersonate OR SeAssignPrimaryToken? → Potato (GodPotato first)
├─ SeBackup OR SeRestore? → [[SeBackupPrivilege]] / [[SeRestorePrivilege]]
├─ SeDebug? → Mimikatz on LSASS
├─ SeTakeOwnership? → takeown + icacls on SAM/service
├─ SeManageVolume? → SeManageVolumeExploit + DLL
├─ SeCreateToken? → token abuse (rare)
└─ None of above → services, **[[AlwaysInstallElevated - MSI Privilege Escalation]]**, [[Windows PrivEsc]]
📌 Notes in WindowsPermissions/
| Note | Privilege |
|---|---|
| SeImpersonatePrivilege | SeImpersonatePrivilege |
| SeAssignPrimaryTokenPrivilege | SeAssignPrimaryTokenPrivilege |
| SeBackupPrivilege | SeBackupPrivilege |
| SeRestorePrivilege | SeRestorePrivilege |
| SeDebugPrivilege | SeDebugPrivilege |
| SeTakeOwnershipPrivilege | SeTakeOwnershipPrivilege |
| SeLoadDriverPrivilege | SeLoadDriverPrivilege |
| SeCreateTokenPrivilege | SeCreateTokenPrivilege |
| SeManageVolumePrivilege | SeManageVolumePrivilege |
| SeManageVolumeExploit | SeManageVolumeExploit tool |
📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'→ Linux > 📌 1) Basic Manual Enumeration