Posts on: Privileges

---

Windows token privileges are the most direct path to SYSTEM on a compromised host. A web shell on an IIS server or a SQL Server xp_cmdshell almost always lands in a context holding SeImpersonatePrivilege — and a single command turns that into NT AUTHORITY\SYSTEM. This file covers each high-value privilege, the tools to abuse it, and the defenses you must bypass on modern Windows (2025–2026). 0. Triage — Which Privilege Do I Have? Run this immediately after landing a shell:

Windows ships with privileged built-in groups whose membership grants powerful rights short of full administrator — and several are a direct path to SYSTEM or Domain Admin. Treat every group below as Tier-0 on a Domain Controller; membership changes should be monitored, and any foothold account that lands in one of them should be treated as a domain-compromise primitive. Triage — Which Group Do I Have? Run this immediately after landing a shell: