Select a privilege-backed impersonation or object-control route

Needs: The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context

Windows commands

REM Baseline
whoami /priv

REM Impersonation-tool variants
PrintSpoofer64.exe -i -c "cmd.exe"

REM Impersonation-tool variants
GodPotato-NET4.exe -cmd "cmd.exe /c whoami > C:\Windows\Temp\token-proof.txt"

REM Backup privilege to local credential material
reg save HKLM\SAM C:\Windows\Temp\SAM.hive
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive

Choose by OS build, architecture, runtime and available trigger. A privilege name alone does not select a working “Potato.” Success is a SYSTEM process/effect followed by whoami /all; connection/token/process errors route back to prerequisites.

Backup privilege to local credential material

# Backup privilege to local credential material
impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL

Verify → Verify the resulting token or concrete protected-object operation, not the tool's success text.

If it fails → Missing token source, filtered token, protected process or driver-signing/build differences change the route; inspect the specific prerequisite. More detail ↓

If → then

A token has the relevant backup rights and protected registry/files are a useful credential source → Use backup privilege to obtain protected local credential material
Needs: Usable backup privilege, compatible backup API/command and a matched protected source set with a writable destination
A controlled Windows host may hold useful logged-on identities → Obtain accessible live logon-session credential material
Needs: Required process/host privileges, useful sessions and compatible architecture; PPL/Credential Guard/protection may prevent access or remove material
An exact vulnerable local component is present after simpler paths are assessed → Select a matching application, driver or kernel exploit
Needs: Affected build/patch/architecture, required service/driver/configuration and compatible exploit assumptions

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Select a privilege-backed impersonation or object-control route

USE WHEN: whoami /priv exposes a relevant token privilege
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: A verified token-backed identity or privileged-object operation

Recognize the clue

Inspect the current token's privileges, then map a relevant privilege to an actual protected operation and available source/trigger.

whoami /priv
whoami /all

SYNTHETIC EXAMPLE OUTPUT

SeImpersonatePrivilege   Impersonate a client after authentication   Enabled

Means: An impersonation capability is present; the privileged authentication source required by a specific tool is not established.

Confirm: Read whoami /priv and whoami /all. Match the exact privilege, enabled state and token context to the technique's required API/trigger, then verify the resulting identity; the privilege name alone is not SYSTEM.

After validation: The required source and privileged token operation work: select that compatible method.
Ruled out in this context: The required authentication service/source is unavailable: reject that tool's chain.
Still inconclusive: Privilege presence alone leaves exploit selection unresolved.

Troubleshooting: Missing token source, filtered token, protected process or driver-signing/build differences change the route; inspect the specific prerequisite.

Privilege	Required next proof
`SeImpersonatePrivilege`	Compatible privileged client/coercion, impersonation level, build/runtime/tool and process creation
`SeAssignPrimaryTokenPrivilege`	Useful primary token plus process/quota requirements
`SeBackupPrivilege`	Enabled privilege, backup-aware read and useful protected data
`SeRestorePrivilege`	Restore-aware write plus privileged consumer/trigger
`SeDebugPrivilege`	Usable target process and no protected-process barrier
`SeLoadDriverPrivilege`	Compatible signed/loadable driver and stable exploit path
`SeTakeOwnershipPrivilege`	Ownership change, then DACL/content control and consumer

Impersonation-tool variants

Choose by OS build, architecture, runtime and available trigger. A privilege name alone does not select a working “Potato.” Success is a SYSTEM process/effect followed by whoami /all; connection/token/process errors route back to prerequisites.

Backup privilege to local credential material

Use the matched hive pair. Output is local credential material, not automatic SYSTEM/domain/remote authorization; classify and validate it through the credential procedure.

Why it works

SeImpersonate, backup/restore, debug, ownership and driver privileges enable different operations. A privilege name does not guarantee a particular exploit tool or a privileged token source.

Worked example · hypothetical

Observation: SeImpersonatePrivilege is present. Test: match a documented tool's service/build/trigger requirements to the host. Illustrative output: the required privileged authentication source is unavailable. Interpretation: reject that tool's route while retaining the privilege observation.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗