https://hackita.it/tags/seassignprimarytokenprivilege/Recent content in SeAssignPrimaryTokenPrivilege on Ethical Hacking | Pentest e Sicurezza Informatica | HackitaHugoitFri, 22 May 2026 00:00:00 +0000https://hackita.it/articoli/seassignprimarytokenprivilege/Fri, 22 May 2026 00:00:00 +0000https://hackita.it/articoli/seassignprimarytokenprivilege/<p>Un admin ha rimosso SeImpersonatePrivilege credendo di aver bloccato i Potato attack. SeAssignPrimaryTokenPrivilege è rimasto intatto — e GodPotato lo usa automaticamente. Stesso risultato, stessi due comandi.</p> <hr> <h2 id="quick-exploit" class="group/anchor-heading"> Quick Exploit <a href="#quick-exploit" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">cmd</span> </div> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-cmd" data-lang="cmd"><span class="line"><span class="cl">whoami /priv </span></span><span class="line"><span class="cl">GodPotato.exe -cmd <span class="s2">&#34;cmd /c whoami&#34;</span></span></span></code></pre></div> </div> <p>Output atteso:</p> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">text</span> </div> <pre tabindex="0"><code>[+] CreateProcessAsUser OK ← usa SeAssignPrimaryTokenPrivilege nt authority\system</code></pre> </div> <hr> <h2 id="cosè-seassignprimarytokenprivilege" class="group/anchor-heading"> Cos&rsquo;è SeAssignPrimaryTokenPrivilege <a href="#cos%c3%a8-seassignprimarytokenprivilege" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2><p>Dove SeImpersonatePrivilege impersona un token nel thread corrente (scope temporaneo), questo privilegio permette di assegnare un token primario a un processo figlio tramite <code>CreateProcessAsUser()</code> prima che venga avviato (scope permanente). Il risultato finale è identico: un processo che gira come SYSTEM. I Potato attack supportano entrambi i percorsi API — se uno manca, usano l&rsquo;altro automaticamente.</p>