SeImpersonatePrivilege
Last updated
Was this helpful?
Last updated
Was this helpful?
The SeImpersonatePrivilege allows a user to operate under another user's security context, typically by impersonating clients via mechanisms like named pipes or RPC. This privilege is normally assigned to administrator accounts and built-in service accounts like LOCAL SERVICE, NETWORK SERVICE, and SERVICE. While rare for standard users, SeImpersonatePrivilege is often accessible when gaining code execution through services like IIS, which commonly run under accounts that have it.
Named pipes are a method of inter-process communication (IPC) in Windows. They let two separate processes—either on the same system or across a network—send and receive data as if they were reading/writing to a file. Think of a named pipe as a virtual file that one process (the server) creates and waits on, while another (the client) connects to it using a known name (like
\\.\pipe\mypipe). Once connected, both processes can exchange data in real time.
In the context of privilege escalation, named pipes can be abused when a privileged process connects to a pipe controlled by a lower-privileged attacker. If the attacker has SeImpersonatePrivilege, they can impersonate the connecting user, effectively hijacking their permissions.
is a tool that leverages a variation of the "potato" attacks to coerce NT AUTHORITY\SYSTEM into connecting to a controlled named pipe. If we have SeImpersonatePrivilege, SigmaPotato lets us escalate to SYSTEM, executing commands or gaining an interactive shell.
Escalate to NT AUTHORITY\SYSTEM on the same session:
