Token impersonation attacks

Token impersonation attacks leverage specific Windows privileges such as SeImpersonatePrivilege to obtain an access token with administrative privileges that we can use to impersonate in order to elevate our privileges.

This process will depend on the version of Windows you are targeting and can be performed through various techniques.

The technique we will be focusing on is known as the Potato attack. This attack has some variations that alter the exploitation process; however, the core principles of the exploitation process remain the same. To fully understand how to successfully impersonate tokens, we will need to take a closer look at how the Potato attack works.

Potato attacks overview

The Potato attack is the name given to a Windows privilege escalation technique that exploits known issues in Windows such as the NTLM relay (specifically the HTTP – SMB relay), NetBIOS Name Service (NBNS) spoofing, WPAD, and Windows Update.

This...