Priv2Admin - Exploitation paths allowing you to (mis)use the Wi

项目说明

The idea is to "translate" Windows OS pri to a path leading to:
1. administrator,
2. integrity and/or confidentiality threat,
3. a threat,
4. just a mess.

Pri are listed and explained at:

If the goal can be achie ways, the priority is
1. Using built-in commands
2. Using PowerShell (only if a working script exists)
3. Using non-OS tools
4. Using any other method

You can check your own pri with whoami /priv. Disabled pri are as good as enabled ones. The only important thing is if you have the pri on the list or not.

Note 1: Whenever the attack path ends with a token creation, you can assume the next step is to create new process using such token and then take control over OS.

Note 2:<br> a. For calling NtQuerySystemInformation()/ZwQuerySystemInformation() directly, you can find required pri here.<br> b. For NtSetSystemInformation()/ZwSetSystemInformation() required pri are listed here here.

Note 3: I am focusing on the OS only. If a pri works in AD but not in the OS itself, I am describing it as not used in the OS. It would be nice if someone digs deeper into AD-oriented scenarios.

Feel free to contribute and/or discuss presented ideas.

| Pri | Impact | Tool | Execution path | Remarks |
| --- | --- | --- | --- | --- |
|SeAssignPrimaryToken| *Admin* | 3rd party tool | *"It would allow a user to impersonate tokens and privesc to nt system using tools such as potato.exe, rottenpotato.exe and juicypotato.exe"* | Thank you Aurélien Chalot for the update. I will try to re-phrase it to something more recipe-like soon. |
|SeAudit| Threat | 3rd party tool | Write events to the Security event log to fool auditing or to o old events. |Writing own events is possible with Authz Report Security Event API.<br> - see PoC by |
|SeBackup| *Admin* | 3rd party tool | 1. Backup the HKLM\SAM and HKLM\SYSTEM registry hives <br> 2. Extract the local accounts hashes from the SAM 数据库 <br> 3. Pass-the-Hash as a member of the local Administrators group <br><br> Alternatively, can be used to read sensiti. | For more information, refer to the SeBackupPri file.<br> - see PoC by |
|SeChangeNotify| None | - | - | Pri held by e. Re it may make the OS (Windows 服务端 2019) unbootable. |
|SeCreateGlobal| ? | ? | ? ||
|SeCreatePagefile| None | *Built-in commands* | Create hiberfil.sys, read it offline, look for sensitive data. | Requires offline access, which leads to admin rights anyway.<br> - See PoC by |
|SeCreatePermanent| ? | ? | ? ||
|SeCreateSymbolicLink| ? | ? | ? ||
|SeCreateToken| *Admin* | 3rd party tool | Create arbitrary token including local admin rights with NtCreateToken.<br> - see PoC by ||
|SeDebug| *Admin* | PowerShell | Duplicate the lsass.exe token. | Script to be found at FuzzySecurity.<br> - See PoC by |
|SeDelegateSession-<br>UserImpersonate| ? | ? | ? | Pri name broken to make the column narrow. |
|SeEnableDelegation| None | - | - | The pri is not used in the Windows OS. |
|SeImpersonate| *Admin* | 3rd party tool | Tools from the *Potato family* (potato.exe, RottenPotato, RottenPotatoNG, Juicy Potato, SweetPotato, RemotePotato0), RogueWinRM, PrintSpoofer, etc. | Similarly to SeAssignPrimaryToken, allows by design to create a process under the security context of another user (using a handle to a token of said user). <br><br> Multiple tools and techniques may be used to obtain the required token. |
|SeIncreaseBasePriority| A | *Built-in commands* | start /realtime SomeCpuIntensiveApp.exe | May be more interesting on servers. |
|SeIncreaseQuota| A | 3rd party tool | Change cpu, memory, and cache limits to some making the OS unbootable. | - Quotas are not checked in the safe mode, which makes repair relatively easy.<br> - The same pri is used for managing registry quotas. |
|SeIncreaseWorkingSet| None | - | - | Pri held by e. Checked when calling fine-tuning memory management functions. |
|SeLoadDriver| *Admin* | 3rd party tool | 1. Load buggy kernel driver such as szkg64.sys<br>2. Exploit the dri<br> <br> Alternatively, the pri may be used to unload security-related drivers with fltMC builtin command. i.e.: fltMC sysmondrv | 1. The szkg64 is listed as C<br>2. The szkg64 exploit code was created by Par |
|SeLockMemory| A | 3rd party tool | Star memory partition by moving pages. | PoC published by Walied Assar () |
|SeMachineAccount| None | - | - |The pri is not used in the Windows OS. |
|SeManage| *Admin* | 3rd party tool | 1. Enable the pri in the token<br>2. Create handle to \\.\C: with SYNCHRONIZE \| FILE_TRAVERSE<br>3. Send the FSCTL_SD_GLOBAL_CHANGE to replace S-1-5-32-544 with S-1-5-32-545<br>4. O utilman.exe etc. | FSCTL_SD_GLOBAL_CHANGE can be made with this piece of code. |
|SeProfileSingleProcess| None | - | - | The pri is checked before changing (and in very limited set of commands, before querying) parameters of Prefetch, SuperFetch, and ReadyBoost. The impact may be adjusted, as the real effect is not known. |
|SeRelabel| Threat | 3rd party tool | Modification of system files by a legitimate administrator | See: MIC documentation<br> <br> Integrity labels provide additional protection, on top of well-known ACLs. Two main scenarios include:<br>- protection against attacks using exploitable applications such as browsers, PDF readers etc.<br>- protection of OS files.<br> <br>SeRelabel present in the token will allow to use WRITE_OWNER access to a resource, including files and folders. Unfortunately, the token with IL less than *High* will ha pri disabled, making it useless for anyone not being an admin already.<br> <br>See great blog post by for details.|
|SeRemoteShutdown| A | *Built-in commands* | shutdown /s /f /m \\server1 /d P:5:19 | The pri is when shutdown/restart request comes from the 网络. 127.0.0.1 scenario to be in. |
|SeReser| None | - | - | It looks like the pri is no longer used and it appeared only in a couple of of winnt.h. You can see it listed i.e. in the 源码 代码 published by Microsoft here. |
|SeRestore| *Admin* | PowerShell | 1. Launch PowerShell/ISE with the SeRestore pri present.<br>2. Enable the pri with Enable-SeRestorePri).<br>3. Rename utilman.exe to utilman.old<br>4. Rename cmd.exe to utilman.exe<br>5. Lock the console and press Win+U| Attack may be detected by some A.<br> <br>Alternati relies on replacing service binaries stored in "Program Files" using the same pri.<br> - see PoC by |
|SeSecurity| Threat | *Built-in commands* |- Clear Security event log: we cl Security<br> <br>- Shrink the Security log to 20MB to make events flushed soon: we sl Security /ms:0<br> <br>- Read Security event log to ha about processes, access and actions of other users within the system.<br> <br>- Knowing what is logged to act under the radar.<br> <br>- Knowing what is logged to generate large number of events effectively purging old ones without leaving obvious e of cleaning. <br> <br>- and changing object SACLs (in practice: auditing settings) | See PoC by |
|SeShutdown| A | *Built-in commands* | shutdown.exe /s /f /t 1 | Allows to call most of NtPowerInformation() levels. To be in. Allows to call NtRaiseHardError() causing immediate BSOD and memory dump, leading potentially to sensiti disclosure - see PoC by |
|SeSyncAgent| None | - | - | The pri is not used in the Windows OS. |
|SeSystemEn| _Unknown_ | 3rd party tool | The pri permits to use NtSetSystemEn, NtModifyDri and some other syscalls to manipulate UEFI . |The pri is required to run sysprep.exe.<p>Additionally:<br>- Firmware en were commonly used on non-Intel platforms in the past, and now slowly return to UEFI world. <br>- The area is highly undocumented.<br>- The potential may be huge (i.e. breaking Secure Boot) but raising the impact le at least PoC.<br> - see PoC by |
|SeSystemProfile| ? | ? | ? ||
|SeSystemtime| Threat | *Built-in commands* | cmd.exe /c date 01-01-01<br>cmd.exe /c time 00:00 | The pri allows to change the system time, potentially leading to audit trail integrity issues, as events will be stored with wrong date/time.<br>- Be careful with date/time formats. Use always-safe if not sure.<br>- Sometimes the name of the pri uses uppercase "T" and is referred as SeSystemTime. |
|SeTakeOwnership| *Admin* | *Built-in commands* |1. takeown.exe /f "%windir%\system32"<br>2. icacls.exe "%windir%\system32" /grant "%username%":F<br>3. Rename cmd.exe to utilman.exe<br>4. Lock the console and press Win+U| Attack may be detected by some A.<br> <br>Alternati relies on replacing service binaries stored in "Program Files" using the same pri.<br> - See PoC by |
|SeTcb| *Admin* | 3rd party tool | Manipulate tokens to ha admin rights included. | Sample 代码+exe creating arbitrary tokens to be found at PsBits. |
|SeTimeZone| Mess | *Built-in commands* | Change the timezone. tzutil /s "Chatham Islands Standard Time" ||
|SeTrustedCredManAccess| Threat | 3rd party tool | Dumping credentials from Credential Manager | Great blog post by .<br> - see PoC by |
|SeUndock| None | - | - | The pri is enabled when undocking, but ne it checked to grant/deny access. In practice it means it is actually unused and cannot lead to any escalation. |
|SeUnsolicitedInput| None | - | - | The pri is not used in the Windows OS. |

Credits:<br>

项目信息

开发语言：未知

Star 数：2515

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Exploitation paths allowing you to (mis)use the Windows Pri to elevate your rights within the OS.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。