list

token::list lists all tokens on the system.

It has the following command line arguments:

General Usage

A low-privileged user can list only own tokens:

mimikatz # token::list
Token Id  : 0
User name :
SID name  :

3844    {0;0008d895} 2 L 588473         SERVER01\tmassie    S-1-5-21-755659916-1915924768-2761631771-1001   (15g,02p)        Primary
964     {0;0008d895} 2 L 651175         SERVER01\tmassie    S-1-5-21-755659916-1915924768-2761631771-1001   (15g,02p)        Primary
760     {0;0008d895} 2 L 659720         SERVER01\tmassie    S-1-5-21-755659916-1915924768-2761631771-1001   (15g,02p)        Primary
1456    {0;0008d895} 2 L 664286         SERVER01\tmassie    S-1-5-21-755659916-1915924768-2761631771-1001   (15g,02p)        Primary
5200    {0;0008d895} 2 L 676578         SERVER01\tmassie    S-1-5-21-755659916-1915924768-2761631771-1001   (15g,02p)        Primary
6164    {0;0008d895} 2 L 5603039        SERVER01\tmassie    S-1-5-21-755659916-1915924768-2761631771-1001   (15g,01p)        Impersonation (Impersonation)

Every line shows one token:

Displayed information (source: kuhl_m_token.c):

  • 6164: Process ID

    • To which process the token belongs.

    • Every process has one primary token and can have multiple impersonation tokens.

    • This ID can be seen in Taskmanager, or Get-Process

  • {0;0008d895}: Logon Session ID (64 bit)

    • higher 32 bit and lower 32 bit

  • 2: Session ID

  • L: Token Elevation Type

    • D: Default

    • F: Full

    • L: Limited

  • 5603039: Token ID

  • SERVER01\tmassie: Username

    • Domain Accounts: domain\username

    • Local Accounts: hostname\username or NT AUTHORITY\USERNAME

  • S-1-5-21-755659916-1915924768-2761631771-1001: SID

  • (15g,01p): Groups and privileges

    • g: Number of groups

    • p: Number of privileges

  • Impersonation: Token Type

    • Unknown

    • Primary

    • Impersonation

  • (Impersonation): Impersonation Level (Only for impersonation tokens)

    • Anonymous: Server cannot impersonate the client

    • Identification: Server can identify client but not impersonate

    • Impersonation: Server can impersonate client’s security context on local system

    • Delegation: Server can impersonate client’s security context on remote systems using cached credentials

As a local admin but without the SeDebugPrivilege privilege, you can see the tokens of other user's as well but not of system users like SYSTEM or NETWORK SERVICE:

With the SeDebugPrivilege privilege enabled, you can see all tokens on the system:

id

List token with specific token id:

user

List token of specific user:

system

List tokens of local SYSTEM account:

admin

List tokens of local admins:

domainadmin

List tokens of domain admins:

enterpriseadmin

List tokens of enterprise admins:

localservice

List tokens of local service accounts:

networkservice

List tokens of network service accounts:

PreviouselevateNextrevert

Last updated