4 - SeImpersonatePrivilege Exploitation
Topics
Introduction to the Windows Shells
Windows Permissions
Reverse Shells in Windows
SeImpersonatePrivilege Exploitation
On Cross Compilation
Windows Services
Weak Service Permissions
Unquoted Service Path
DLL Hijacking
Always Install Elevated
Files with Sensitive Data
Windows Hashes
Stored Credentials and the Windows Vault
Scheduled Task
Critical Registry Paths
Useful Tools
AMSI Bypass
What is SeImpersonatePrivilege?
The SeImpersonatePrivilege, or "Impersonate a client after authentication," is a user right in Windows that allows programs running on behalf of a user to impersonate another client.
This privilege is primarily used in client-server scenarios, enabling a server process to impersonate the client process to perform tasks on its behalf.
Security Implications
If an attacker has the SeImpersonatePrivilege, they can:
Create a service to trick clients into connecting to it.
Impersonate the connected client’s privileges, potentially escalating their own access to SYSTEM. This makes
SeImpersonatePrivilegea common target in privilege escalation attacks.
Checking for SeImpersonatePrivilege
To verify whether the current user has this privilege, run the following:
Sample Output
If the SeImpersonatePrivilege is enabled, the user can exploit it for privilege escalation using tools like PrintSpoofer or GodPotato.
Assigning SeImpersonatePrivilege
If you want to assign the SeImpersonatePrivilege to a user:
Open the Local Group Policy Editor:
Navigate to:
Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.Locate "Impersonate a client after authentication."
Right-click and select Properties, then click Add User or Group.
Privilege Escalation with SeImpersonatePrivilege
Initial Setup
Start a Listener on the Attacker Machine
Download Netcat on the Victim Machine
Exploiting with PrintSpoofer
PrintSpoofer leverages misconfigured print spooler services to escalate privileges to SYSTEM.
Download the Exploit
Execute the Exploit Run the following command to establish a SYSTEM shell:
Exploiting with GodPotato
GodPotato is a tool that exploits COM and DCOM misconfigurations to achieve SYSTEM privileges.
Identify .NET Framework Version Use the following command to determine the .NET version installed:
Download the Appropriate GodPotato Version Depending on the .NET version:
.NET 2.0:
.NET 3.5:
.NET 4.0:
Execute the Exploit Use the appropriate executable to escalate privileges and spawn a reverse shell:
Other Resources
Disclaimer
❗ Never use tools and techniques on real IP addresses, hosts or networks without proper authorization!❗
Last updated