Token & Privilege Impersonation

You have a foothold on a Windows host and want to impersonate other users or escalate by abusing Windows token mechanics.

**Windows Token Fundamentals**
- What is the difference between a primary token and an impersonation token?
- What privilege levels are required to impersonate tokens? (SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege)
- Which Windows service accounts have SeImpersonatePrivilege by default and why?

**Token Stealing**
- How do you list available tokens on a system using Incognito or Meterpreter?
- What does "impersonating" a Domain Admin token give you vs. "stealing" it?
- How do you use `CreateProcessWithTokenW` or `ImpersonateLoggedOnUser` to leverage a stolen token?

**Potato Attacks**
- What is the "Potato" family of attacks and what do they all exploit?
- When does PrintSpoofer apply vs Juicy Potato vs Sweet Potato?
- What Windows version and patch level affects which Potato variant works?

**Delegation Impersonation**
- How does S4U2Self allow a service to impersonate any domain user?
- When is this useful in lateral movement from a machine with constrained delegation?

**Practical Usage**
- On a Windows host where you have a service account with SeImpersonatePrivilege, walk through the full chain to SYSTEM
- How do you pass from a token on one host to a remote session on another host?

Output:
- Token abuse decision tree: which technique for which privilege level
- Step-by-step PrintSpoofer / SweetPotato chain
- Detection signatures defenders look for