> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/privileges-in-depth.md). # Privileges In-Depth ### Privileges and Access Tokens **Tokens** provide the security context of a given process or thread - specifically, they include information about the user's identity and privileges as related to a specific process or thread. A user will be assigned a token when they authenticate to a system. A copy of this token will be 'presented' to each process the user interacts with. Access rights are separate from privileges. Access rights grant or deny user access to securable objects. A **Security Principal** is anything that can be authenticated by the Windows operating system, including user and computer accounts, processes that run in a security context, or groups that these accounts belong to. A security principal is identified by a **Security Identifier (SID)**. **Access Control Entries** **(ACEs)** are stored within an object's **security descriptor** (which contains info about securable objects such as access rights). An access token is compared agains the ACEs to permit or deny access.
#### Primary Tokens Present the default security information for a process or thread #### Impersonation Tokens Consider a user accessing an SMB share, the server requires a copy of the user's token to validate that the user has sufficient permissions. As such, the executing server-side client thread includes an impersonation token for the user in addition to the thread's primary token, and utilizes the impersonation token to perform access checks for the user's actions. #### Restricted Tokens or Filtered Admin Tokens Subset of primary or impersonation tokens, modified to control privileges or permissions. Allows the system to remove privileges, add deny-only ACEs, or perform other access right changes. A restricted SID identified during the initial token creation by LSA will produce a new access token with reduced privileges. #### Resources * [Abusing Token Privileges for LPE (3.1 - Exploitable Privileges)](https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt) * [The Art of Memory Forensics](https://memoryanalysis.net/amf/) (p173,186,197-199) * [Malware Analysts Cookbook](https://www.wiley.com/en-us/Malware+Analyst%27s+Cookbook+and+DVD%3A+Tools+and+Techniques+for+Fighting+Malicious+Code-p-9780470613030) (p58, 231, 589) * [Windows Malware Analysis Essentials](https://www.oreilly.com/library/view/windows-malware-analysis/9781785281518/) (p143) ### User Rights For the full list of user rights see the document [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment). | Setting Constant | Setting Name | Standard Assignment | Description | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SeImpersonate | Impersonate a client after authentication | Administrators, Local Service, Network Service, Service | A token that allows a process to impersonate another user or account after successful authentication. See [The Power of SeImpersonation](https://micahvandeusen.com/blog/the-power-of-seimpersonation/) | | SeNetworkLogonRight | Access this computer from the network | Administrators Authenticated Users | Determines which users can connect to the device from the network. This is required by network protocols such as SMB, NetBIOS, CIFS, and COM+ | | SeBackupPrivilege | Backup files and directories | Administrators | Allows users to bypass file, directory, registry, and other persistent object permissions for the purposes of backing up the system | | SeRemoteInteractiveLogonRight | Allow log on through Remote Desktop Services | Administrators, Remote Desktop Users | Determines which users and groups can access the login screen of a remote device through Remote Desktop Services. Note however that a user may establish a Remote Desktop Services connection to a particular server but not be able to log onto the console of that same server. | | SeSecurityPrivilege | [Manage auditing and security log](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log) | Administrators | Determines which users can specify object access audit options for individual resources such as files, AD objects, and registry keys. These objects specify their system access control lists (SACL). Such users may also view and clear the Security log in Event Viewer. | | SeTakeOwnershipPrivilege | Take ownership of files or other objects | Administrators | Determines which users can take ownership of any securable object in the device, including AD objects, NTFS files and folders, printers, registry keys, services, processes, and threads | | SeDebugPrivilege | Debug programs | Administrators |

Determines which users can attach to or open any process, even a process they do not own. Devs who are debugging their application do not need this user right. Devs who are debugging new system components need this right. The right provides access to sensitive and critical OS components

| | SeLoadDriverPrivilege | Load and unload device drivers | Administrators | Determines which users can dynamically load and unload device drivers. Right not required if a signed driver for the new hardware exists in the driver.cab file on the device. Device drivers run as highly privileged code. | | SeRestorePrivilege | Restore files and directories | Administrators | Determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories. It determines which users can set valid security principals as the owner of an object | | SeTcbPrivilege | Act as part of the OS | Administrators, Local Service, Network Service, Service | Determines whether a process can assume the identity of any user and, through this, obtain access to resources that the targeted user is permitted to access (impersonation). May be assigned to antivirus or backup tools that need the ability to access all system files for scans or backups. This privilege should be reserved for service accounts requiring this access for legitimate activities. |