SeImpersonatePrivilege privilege escalation using Juicy Potato

Wed, 09 Mar 2022 00:00:00 +0000

Exploiting ‘‘SeImpersonatePrivilege’ using Juicypotato for privilege escalation Link to heading

Lets take a sceanrio we have initail reverse shell or nomral user shell which requires to be elvated as Administrator.Checking the Privilege of cuurent user we have noticed “SeImpersonatePrivilege” is enabled.

whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State 
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeShutdownPrivilege Shut down the system Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled 
SeUndockPrivilege Remove computer from docking station Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Windows\SysWOW64\inetsrv>

The below one privilege can be exploited using the [Juicypotato](Release Fresh potatoes · ohpe/juicy-potato · GitHub) for most of the windows machine

Windows Privilege Escalation on rchitect

SeImpersonatePrivilege privilege escalation using Juicy Potato

Exploiting ‘‘SeImpersonatePrivilege’ using Juicypotato for privilege escalation Link to heading