elevate

token::elevate can be used to impersonate a token. By default it will impersonate a token from SYSTEM and therefore elevate permissions to NT AUTHORITY\SYSTEM.

It has the following command line arguments:

  • /id: Impersonate the specified token

  • /process: Impersonate the token of the running process

  • /user: Impersonate the token of the specified user

  • /admin: Impersonate a token of builtin local administrators

  • /domainadmin: Impersonate a token with Domain Admin privileges

  • /enterpriseadmin: Impersonate a token with Enterprise Admin privileges

  • /localservice: NT AUTHORITY\LOCAL SERVICE token impersonation

  • /networkservice: NT AUTHORITY\NETWORK SERVICE token impersonation

Impersonated tokens will be impersonation tokens (thread tokens) and only work in threads. To impersonate a token in a new process, use token::run.

Impersonate Token in a New Thread

List current token:

mimikatz # token::whoami
 * Process Token : {0;000831c5} 3 F 2396391     SERVER01\tmassie    S-1-5-21-755659916-1915924768-2761631771-1001   (15g,24p)       Primary
 * Thread Token  : no token

The output shows:

  • The primary (process) token belongs to the current user.

  • There is no impersonation (thread) token.

List tokens of user to impersonate:

Use a primary token of the target user (one that is linked to a logonsession):

The output shows:

  • The primary (process) token is still the same of the initial user. The token::elevate command will not change the primary token.

  • There is now a new impersonation (thread) token for the impersonated user. The impersonation level is delegation. It's therefore possible to use the token in a new thread and access local and remote resources.

  • It's not possible to start a new command (misc::cmd) as the impersonated user, because the impersonated token is an impersonation token and no process token. To impersonate a token in a new process, use token::run.

  • All mimikatz commands are now using the impersonation token for new threads.

After impersonating the user (who is domain admin), it's e.g. possible to use lsadump::dcsync:

Other Examples

By default, token::elevate elevates to SYSTEM:

  • All mimikatz commands (new threads) are therefore executed as SYSTEM.

Elevate to any logged in domain admin:

PrevioustokenNextlist

Last updated