Access Token Manipulation

Windows
Local Privilege Escalation

Windows access tokens record user IDs, groups, privileges, and other information. Before investigating token manipulation, check which privileges are effective in the current process.

SeAssignPrimaryTokenPrivilege: DISABLED
SeIncreaseQuotaPrivilege: DISABLED
SeChangeNotifyPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
SeImpersonatePrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
SeCreateGlobalPrivilege: SE_PRIVILEGE_ENABLED_BY_DEFAULT, SE_PRIVILEGE_ENABLED
SeIncreaseWorkingSetPrivilege: DISABLED

The output above is an example of whoami /priv. Distinguish privileges shown as DISABLED from those that are enabled.

For the underlying mechanism, see Windows Tokens. For examples of manipulation, see Abusing Tokens.