How do I install the Privesc Windows Tokens skill?

Run npx skillmds@latest add noorqureshi/privesc-windows-tokens in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Privesc Windows Tokens safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Privesc Windows Tokens?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Privesc Windows Tokens free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Privesc Windows Tokens?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Privesc Windows Tokens by noorqureshi

Name: Privesc Windows Tokens
Author: NoorQureshi

Privesc Windows Tokens

Windows privilege escalation via token impersonation privileges — SeImpersonate/SeAssignPrimaryToken (the Potato family) and related token abuse to SYSTEM. Load with a Windows shell as a service/web account, on "SeImpersonate", "whoami /priv", IIS/MSSQL service context, or "got a shell on Windows".

NoorQureshi Updated Sep 17, 2026

File contents

Windows token-impersonation privesc (Potato family)

When it applies

You have code execution on Windows as a service or web account (IIS iis apppool, MSSQL, a service) that holds SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege). These accounts can't do much directly but can impersonate a token — and coax SYSTEM into handing one over.

Why it works

SeImpersonate lets a process act with any token it can obtain. The "Potato" technique tricks a SYSTEM service (via a local RPC/named-pipe/COM authentication) into authenticating to an attacker-controlled pipe; the low-priv process impersonates that SYSTEM token and spawns a process as SYSTEM.

Method

Confirm the privilege: whoami /priv — look for SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege) Enabled.
Pick the right Potato for the OS/build:
- PrintSpoofer — modern, uses the print spooler named pipe: PrintSpoofer.exe -i -c cmd.
- GodPotato — works across Windows 8–11 / Server 2012–2022 via DCOM: GodPotato -cmd "cmd /c whoami".
- JuicyPotatoNG / RoguePotato — where applicable.
Get SYSTEM: run the tool to spawn a SYSTEM shell or run a command (add a user, drop a beacon).
If no SeImpersonate: pivot to other Windows vectors — unquoted service paths, weak service perms (PowerUp/winPEAS), AlwaysInstallElevated, DLL hijacking, autoruns.

Gotchas

The right Potato depends on Windows version/patch — if one fails, try GodPotato (widest coverage).
Print Spooler disabled → PrintSpoofer won't work; use a DCOM-based one.
Service accounts (IIS/MSSQL) almost always have SeImpersonate — check whoami /priv first, always.

Verify success

A shell/command running as NT AUTHORITY\SYSTEM (whoami = SYSTEM), from the impersonation.

References

itm4n PrintSpoofer; GodPotato; "Rotten/Juicy Potato" lineage; winPEAS/PowerUp for the alternatives.

---name: privesc-windows-tokensdescription: Windows privilege escalation via token impersonation privileges — SeImpersonate/SeAssignPrimaryToken (the Potato family) and related token abuse to SYSTEM. Load with a Windows shell as a service/web account, on "SeImpersonate", "whoami /priv", IIS/MSSQL service context, or "got a shell on Windows".---# Windows token-impersonation privesc (Potato family)## When it appliesYou have code execution on Windows as a service or web account (IIS `iis apppool`, MSSQL, a service)that holds **`SeImpersonatePrivilege`** (or `SeAssignPrimaryTokenPrivilege`). These accounts can'tdo much directly but can impersonate a token — and coax SYSTEM into handing one over.## Why it works`SeImpersonate` lets a process act with any token it can obtain. The "Potato" technique tricks aSYSTEM service (via a local RPC/named-pipe/COM authentication) into authenticating to an attacker-controlledpipe; the low-priv process impersonates that SYSTEM token and spawns a process as SYSTEM.## Method1. **Confirm the privilege**: `whoami /priv` — look for `SeImpersonatePrivilege` (or `SeAssignPrimaryTokenPrivilege`) **Enabled**.2. **Pick the right Potato for the OS/build**: - **PrintSpoofer** — modern, uses the print spooler named pipe: `PrintSpoofer.exe -i -c cmd`. - **GodPotato** — works across Windows 8–11 / Server 2012–2022 via DCOM: `GodPotato -cmd "cmd /c whoami"`. - **JuicyPotatoNG** / RoguePotato — where applicable.3. **Get SYSTEM**: run the tool to spawn a SYSTEM shell or run a command (add a user, drop a beacon).4. **If no SeImpersonate**: pivot to other Windows vectors — unquoted service paths, weak service perms (`PowerUp`/winPEAS), AlwaysInstallElevated, DLL hijacking, autoruns.## Gotchas- The right Potato depends on Windows version/patch — if one fails, try GodPotato (widest coverage).- Print Spooler disabled → PrintSpoofer won't work; use a DCOM-based one.- Service accounts (IIS/MSSQL) almost always have SeImpersonate — check `whoami /priv` first, always.## Verify successA shell/command running as `NT AUTHORITY\SYSTEM` (`whoami` = SYSTEM), from the impersonation.## Referencesitm4n PrintSpoofer; GodPotato; "Rotten/Juicy Potato" lineage; winPEAS/PowerUp for the alternatives.

Frequently asked questions