Academy Node
SeImpersonatePrivilege
SeImpersonatePrivilege allows token impersonation. In vulnerable contexts, it can lead to SYSTEM.
Intermediate100 XPWindows Privilege Escalation
Why it matters
It is one of the most common Windows privilege escalation findings on OSCP-style boxes.
How to identify it
- Run whoami /priv.
- Look for SeImpersonatePrivilege enabled.
- Common on IIS, MSSQL, or local service contexts.
BloodHound indicators
- Not usually a BloodHound edge
Expected output
- SeImpersonatePrivilege Enabled
Success looks like
- Exploit produces NT AUTHORITY\\SYSTEM shell in lab/CTF.
Failure looks like
- Privilege absent.
- Exploit blocked by OS patch level.
- Payload architecture mismatch.
Troubleshooting
- Check OS version.
- Check process architecture.
- Try alternate potato-family exploit appropriate to the lab.
Common mistakes
- Using x64 payload on x86 process.
- Forgetting listener.
- Not checking AV interference.
Alternative attacks
- Writable service
- AlwaysInstallElevated
- Unquoted service path
What to try next
- Run local enumeration.
- Check service context.
- Attempt appropriate token abuse in authorized lab.
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.