Token Impersonation

Privilege escalation via access token manipulation. Steal and impersonate user/process tokens to elevate privileges.

📖 Theory Panel Active

Token Impersonation

Steal and Reuse Authentication Tokens

Requires: Code execution • Difficulty: Intermediate • Impact: High

💻 Desktop Experience Available

View this module on desktop for an interactive Token Impersonation privilege escalation simulation.

Token Impersonation is an Active Directory attack technique that allows attackers to steal and reuse authentication tokens from other processes or users. Windows uses access tokens to represent user identity and privileges. By impersonating high-privilege tokens, attackers can escalate privileges or access resources without knowing passwords.

How Windows Tokens Work (Normal):

User logs on, Windows creates access token with user's SID and privileges
Token contains: user identity, group memberships, privileges (SeDebugPrivilege, etc.)
Processes inherit token from parent or user context
Windows uses token to authorize access to resources
Token is destroyed when user logs off

Attack Exploit:

Attackers use tools like Mimikatz to steal tokens from running processes. High-privilege tokens (from SYSTEM, domain admins, or service accounts) can be impersonated to gain elevated access. This technique allows privilege escalation without password cracking or credential theft.

Why It's Effective: Tokens exist in memory for all running processes. If an attacker has code execution (even as a low-privilege user), they can steal tokens from high-privilege processes. No network traffic, no authentication attempts—just memory manipulation.

Legal & Ethical Warning

Token Impersonation techniques should only be used in authorized penetration testing, red team engagements, or controlled lab environments. Unauthorized access to computer systems is illegal under CFAA and equivalent laws worldwide. Always obtain written permission before testing.

📡 Interactive Simulation Mode

Token Impersonation

Steal authentication tokens from running processes. Impersonate high-privilege users. Escalate privileges without passwords.

Token Theft & Impersonation

Memory Access → Token Extraction → Impersonation

Current User: CORP\lowpriv

○ IDLE

Available Tokens

Mission Brief

Windows stores authentication tokens in process memory. Attackers use tools like Mimikatz to steal tokens from high-privilege processes and impersonate them to gain elevated access. No password needed—just memory access.

Attack Chain

1. Code Execution: Initial access provides code execution
2. Enumerate Tokens: List available tokens on system
3. Steal Token: Extract token from high-privilege process
4. Impersonate: Use stolen token to gain privileges
5. Escalate: Use elevated privileges for further access

Why It Works

• Tokens in memory: All processes have tokens in memory
• SeDebugPrivilege: Allows access to other process memory
• No authentication: Token theft doesn't require passwords
• High-privilege targets: SYSTEM and domain admin tokens available
• Memory-based: Harder to detect than network attacks

Critical Requirements

Requires code execution and SeDebugPrivilege to access process memory. Often used after initial compromise for privilege escalation.

OPSEC: Training only. Unauthorized access to production systems is a federal crime. Token Impersonation is MITRE ATT&CK technique T1134.