Token Elevation
Last updated
Was this helpful?
Last updated
Was this helpful?
Was this helpful?
Windows uses a split-token model for accounts with administrative rights. By default, the session runs with a standard UAC token that restricts most privileges, while a full elevated token containing the complete privilege set remains unused until explicitly invoked. Privilege escalation can be achieved by launching a shell with the elevated token, granting immediate access to all administrative rights already assigned to the account. This shift removes UAC restrictions and enables full local administrator control for further operations.
# Initial session as x7331 (normal shell)
> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
# Second session as x7331 (admin shell)
> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= =================================== ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeSystemtimePrivilege Change the system time Disabled
SeBackupPrivilege Back up files and directories Disabled
SeRestorePrivilege Restore files and directories Disabled
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled