> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/squid/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/squid/priv-escalation.md).

# Priv Escalation

Yo what the fuck.

So basically from the box we came in with the user called "nt authority\local service"

Basically this user and the user network service come with limited sets of privileges that we can get back. Once we have the SeImpersonatePrivilege, the only thing left to do is execute a potato attack. 

{% embed url="<https://github.com/itm4n/FullPowers>" %}

Once we transfer the executable to the target. Here is the POC.

Before:&#x20;

![](https://3120179353-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGCVlbbrFxN38nZXPDpwf%2Fuploads%2Fs4CBQ4bPvqaAYukiZB0X%2F2022-07-28_01-18.png?alt=media\&token=7ed27e5c-e466-43d4-8664-2aec0b1519a6)

After:

![](https://3120179353-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGCVlbbrFxN38nZXPDpwf%2Fuploads%2FetpUfilRTyLOwkJ1spJ7%2F2022-07-28_01-23.png?alt=media\&token=3b2b8f30-92bc-4552-9ba0-1bfff968fe7d)

After having the SeImpersonatePrivilege all we have left to do is run PrintSpoofer.exe

![](https://3120179353-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGCVlbbrFxN38nZXPDpwf%2Fuploads%2FzoIvF4ISRh4vay7EDl93%2F2022-07-28_01-24.png?alt=media\&token=e4d33310-c420-4782-bcde-7607c59f1508)