Windows Token Impersonation
Windows Token Impersonation helps penetration testers escalate privileges on Windows systems by leveraging dangerous token privileges like SeImpersonate and SeDebug. The skill guides you through obtaining a service account shell, checking for exploitable privileges, and using tools like JuicyPotato, PrintSpoofer, and GodPotato to reach SYSTEM.
Windows Token Impersonation exploits dangerous token privileges to escalate from service accounts to SYSTEM on Windows.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-04-01
Windows Token Impersonation exploits dangerous token privileges to escalate from service accounts to SYSTEM on Windows. Windows Token Impersonation helps penetration testers escalate privileges on Windows systems by leveraging dangerous token privileges like SeImpersonate and SeDebug. The skill guides you through obtaining a service account shell, checking for exploitable privileges, and using tools like JuicyPotato, PrintSpoofer, and GodPotato to reach SYSTEM.
Use it when
- Windows Token Impersonation teaches the process of impersonating user tokens by first identifying which privileges are available.
- Windows Token Impersonation covers three primary exploitation tools: JuicyPotato, PrintSpoofer, and GodPotato.
Install
blacklanternsecurity/red-run/windows-token-impersonation · repository language: Python
generated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is Windows Token Impersonation and how does it work?
Windows Token Impersonation is a technique for escalating privileges on Windows systems by leveraging dangerous token privileges like SeImpersonate and SeDebug. The skill guides you through obtaining a service account shell, checking for exploitable privileges, and using tools like JuicyPotato, PrintSpoofer, and GodPotato to reach SYSTEM access.
How do you impersonate a user token on Windows systems?
Windows Token Impersonation teaches the process of impersonating user tokens by first identifying which privileges are available on your current account. Once you confirm SeImpersonate or SeDebug privileges exist, you can use exploitation tools to interact with higher-privileged processes and assume their token context to execute commands at elevated privilege levels.
What are the main tools used for Windows token impersonation?
Windows Token Impersonation covers three primary exploitation tools: JuicyPotato, PrintSpoofer, and GodPotato. Each tool exploits different Windows mechanisms to perform token impersonation attacks. The skill teaches when and how to deploy each tool depending on your target system's configuration and available privileges.
Can Windows token impersonation be used for lateral movement?
Yes, Windows Token Impersonation enables lateral movement by allowing attackers to execute commands under different user contexts after impersonating their tokens. Once you achieve SYSTEM or another privileged account's token, you can move across the network using those elevated credentials to access additional systems and resources.
What privileges enable Windows token impersonation attacks?
Windows Token Impersonation exploits dangerous token privileges, primarily SeImpersonate and SeDebug. The skill teaches you to check for these exploitable privileges on your current account. When present, these privileges allow you to interact with and assume the tokens of other processes, enabling privilege escalation to SYSTEM.
How can defenders detect and prevent token impersonation?
Windows Token Impersonation covers defensive perspectives by explaining token impersonation techniques so security teams understand the attack surface. Defenders can monitor for suspicious token privilege usage, restrict SeImpersonate and SeDebug assignments to trusted accounts, and implement detection rules for exploitation tool behavior patterns.
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Perform token impersonation attacks on Windows systems”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This playbook teaches you how to move from low-privilege shell access to SYSTEM or admin on Windows through systematic enumeration and exploitation. It covers token manipulation, Potato family exploits, weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
This skill guides penetration testers through identifying and exploiting Windows kernel vulnerabilities for privilege escalation. It covers automated vulnerability assessment using tools like WES-NG and Watson, then walks through exploitation of named CVEs including PrintNightmare, EternalBlue, and others, with emphasis on reliability and crash risk mitigation.
privesc-windows guides you through multiple privilege-escalation paths on Windows hosts, from token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato) and UAC bypass techniques to service/DLL hijacking and kernel exploits. It covers enumeration, exploitation, and credential harvesting with tactical OPSEC guidance and detection evasion for each method.
Windows Boundaries equips you with techniques and tools to cross Windows security boundaries—from kernel/user mode transitions via win32k/dxgkrnl exploits and BYOVD drivers, to UAC elevation, AppContainer/LPAC sandbox escapes, PPL circumvention, and RPC/ALPC-based token impersonation. Includes enumeration scripts, proof-of-concept exploits, and OPSEC guidance for each attack vector.
Locate and extract credentials cached on Windows systems through registry queries, file searches, shadow copies, and DPAPI decryption. Covers browser passwords, saved sessions, unattend files, and vault entries accessible without domain access.
Exploitation guides you through the full attack chain: finding public exploits via Exploit-DB, executing Metasploit modules against identified vulnerabilities, and crafting standalone payloads with msfvenom. Use it to move from vulnerability discovery to shell establishment during authorized security assessments.
More skills Auth Coercion Relay (GPL-3.0) · Windows Discovery (GPL-3.0) · metasploit-framework (MIT) · Av Edr Evasion (GPL-3.0)