# Privesc Windows Tokens

> Windows privilege escalation via token impersonation privileges — SeImpersonate/SeAssignPrimaryToken (the Potato family) and related token abuse to SYSTEM. Load with a Windows shell as a service/web account, on "SeImpersonate", "whoami /priv", IIS/MSSQL service context, or "got a shell on Windows".

- Skill: `noorqureshi/privesc-windows-tokens` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/privesc-windows-tokens`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/privesc-windows-tokens/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/privesc-windows-tokens

---


# Windows token-impersonation privesc (Potato family)

## When it applies
You have code execution on Windows as a service or web account (IIS `iis apppool`, MSSQL, a service)
that holds **`SeImpersonatePrivilege`** (or `SeAssignPrimaryTokenPrivilege`). These accounts can't
do much directly but can impersonate a token — and coax SYSTEM into handing one over.

## Why it works
`SeImpersonate` lets a process act with any token it can obtain. The "Potato" technique tricks a
SYSTEM service (via a local RPC/named-pipe/COM authentication) into authenticating to an attacker-controlled
pipe; the low-priv process impersonates that SYSTEM token and spawns a process as SYSTEM.

## Method
1. **Confirm the privilege**: `whoami /priv` — look for `SeImpersonatePrivilege` (or `SeAssignPrimaryTokenPrivilege`) **Enabled**.
2. **Pick the right Potato for the OS/build**:
   - **PrintSpoofer** — modern, uses the print spooler named pipe: `PrintSpoofer.exe -i -c cmd`.
   - **GodPotato** — works across Windows 8–11 / Server 2012–2022 via DCOM: `GodPotato -cmd "cmd /c whoami"`.
   - **JuicyPotatoNG** / RoguePotato — where applicable.
3. **Get SYSTEM**: run the tool to spawn a SYSTEM shell or run a command (add a user, drop a beacon).
4. **If no SeImpersonate**: pivot to other Windows vectors — unquoted service paths, weak service
   perms (`PowerUp`/winPEAS), AlwaysInstallElevated, DLL hijacking, autoruns.

## Gotchas
- The right Potato depends on Windows version/patch — if one fails, try GodPotato (widest coverage).
- Print Spooler disabled → PrintSpoofer won't work; use a DCOM-based one.
- Service accounts (IIS/MSSQL) almost always have SeImpersonate — check `whoami /priv` first, always.

## Verify success
A shell/command running as `NT AUTHORITY\SYSTEM` (`whoami` = SYSTEM), from the impersonation.

## References
itm4n PrintSpoofer; GodPotato; "Rotten/Juicy Potato" lineage; winPEAS/PowerUp for the alternatives.