All right.
Try to stay away from the PowerPoint in this video.
So let's say that we've owned a machine and we run.
Who am I slash press.
Remember we ran this in the enumeration section and we pull down these different privileges and you
could see kind of a description that comes back.
This is an example.
If we are on just a regular shell where we've dropped into a shell.
Who am I slash prev.
Pull down privileges.
Well we could see some of these some of these really OK.
If we have the ability to shut down a system here we don't.
Can we move a computer from docking station and we don't have that privilege either.
So these some of these are just like OK I don't see the escalation here and that's probably because
there isn't really an escalation change of time zone etc. But there are some of these that are bad like
this impersonate privilege.
Now think about what impersonate is token impersonation.
Yes.
You got it.
So impersonates one of the bad ones of this change notify.
Could be one as well bypassed traverse checking.
There's a few in here that are bad now just as another example I can bring up the maturity version of
it which is just get prisons and you can see we've got the same kind of things in here.
Just shows you the privileges from a different perspective and just as s he changed notify privilege
so you could see what privileges are enabled on this system.
Now there are several that can be malicious.
Now of course I'm going to come back to our payload all the things and show you some of these impersonation
privileges.
So if you're interested this is where it's at.
This tells you a little bit more about it and how they are important.
There's also a if you click on this right here privy to Aban there's a list of all the different types
of privileges and how they can be escalated or potentially escalated or if they're even worth escalating.
So this is a great resource as well.
But here are the key common ones and I'm not going to cover all of these in depth but let's talk about
them now.
S.E. assign primary token.
This is the same thing as the impersonate you'll see that in person actually not on this list but it's
the same thing.
And look it says this allows us to impersonate tokens and print asked to the ante system using tools
such as potato rotten potato and juicy potato a little bit of foreshadowing potato attacks.
All right.
Backup if we can if we can perform backup we can read sensitive files create a token we can create tokens.
And it kind of tells you just along the lines of what we're capable of doing here if we have debug we
can duplicate the Alsace.
That's pretty good.
The restore as well and take ownership is another big one where you could take ownership of a file.
So that's also one if you see this enabled really the one that we're looking for is this Essie assigned
primary token or Essie impersonate.
So if you see that running immediately just think hey I might have a potato attack here.
So in the next video we'll talk about what these potato attacks are and how they're important.
I just want to get your wheels spinning right now on these different these different privileges that
allow us to escalate.
So this focus for this segment is going to be the assigned primary token or again that impersonate privilege.
OK.
So S.E. impersonate so let's go ahead move onto the next video we talk about potato attacks what they
are and then we're going to move on to our box and see how we can exploit using potato tax.