Question

During an internal engagement, you have obtained a low-privileged shell as a service account on a Windows Server 2019 host. Running 'whoami /priv' shows that SeImpersonatePrivilege is enabled for your current context. Local exploit suggesters indicate the host is unpatched. Which privilege escalation technique most directly leverages this specific privilege to obtain SYSTEM?

Accepted Answer

Run a potato-style attack (e.g., PrintSpoofer/JuicyPotato) to coerce a SYSTEM token and impersonate it

Answer

Abuse an unquoted service path by planting a malicious executable in a writable parent directory

Answer

Dump LSASS with Mimikatz to extract cleartext credentials for a domain administrator

Answer

Modify the registry AlwaysInstallElevated keys to install a malicious MSI as SYSTEM