Token impersonation
Last updated
Last updated
Windows identifies users by generating an access token assigned to each user. This token contains information about the user's privileges. When a user runs a process or thread, the primary token is assigned, specifying the permissions for that process. A thread can also have an impersonation token assigned, which provides a different security context; in this case, the process will run based on the impersonation token instead of the primary token.
Checking if current user has the SeImpersonatePrivilege :
The "Potato" tools exploit misconfigurations or vulnerabilities in how Windows handles inter-process communication, specifically with services that trust and elevate tokens such as NT AUTHORITY\SYSTEM.
is a modern successor to many previous potato exploits. It's designed to work across various versions of Windows, making it versatile.
is a privilege escalation exploit designed for Windows 10 1809 and above, including Windows Server 2019.
is a privilege escalation exploit designed for Windows 10 prior to 1809 or Server prior to 2019.1809 and above, including Windows Server 2019.
