takeown.exe

  • File Path: C:\WINDOWS\system32\takeown.exe
  • Description: Takes ownership of a file

Hashes

Type Hash
MD5 0806D44443E3F15A9F5063E3CBE261D2
SHA1 B3F65971F5E0201C4B97BDF5EBB87189E0287553
SHA256 9CE1D32186F041B669D3CA1AFB12DC5F6F7C1EA93267DE38C2FD5AA18A04FB0A
SHA384 84628851C451327ABDD4729001EABB627BD64D8E2AA38DAC287A2344E2F0C205AE0C4C4D40994833D375EE17A6C49EC3
SHA512 339944597E29ECCFC6B562C6ECDAACF285898BD77A00BD612CFB024D441B294239F6610292DB8DE5E1ACAFC5518AF631C88A3AEF57D73CD94A310B73AC30637D
SSDEEP 1536:UGBDJG+6iXccvd/hCJ02qPjhI/flLbUmzmY4BnG9RpWf1YaIWmv7:UcH9XZ/CJ09S/flLbUmzQGRpO1YaInj
IMP 5E31D6F290F2F034D88EC70C1026C6AB
PESHA1 B267B37E6DE399799FD41A50F013F49075F1C0D4
PE256 9A278EA418B780329514EFE5189C65A480CA4D3DFCD4B6E8341770A45336F8A4

Runtime Data

Usage (stdout):


TAKEOWN [/S system [/U username [/P [password]]]]
        /F filename [/A] [/R [/D prompt]]

Description:
    This tool allows an administrator to recover access to a file that
    was denied by re-assigning file ownership.

Parameter List: 
    /S           system          Specifies the remote system to
                                 connect to.

    /U           [domain\]user   Specifies the user context under
                                 which the command should execute.

    /P           [password]      Specifies the password for the
                                 given user context.
                                 Prompts for input if omitted.

    /F           filename        Specifies the filename or directory
                                 name pattern. Wildcard "*" can be used
                                 to specify the pattern. Allows
                                 sharename\filename.

    /A                           Gives ownership to the administrators
                                 group instead of the current user.

    /R                           Recurse: instructs tool to operate on
                                 files in specified directory and all 
                                 subdirectories.

    /D           prompt          Default answer used when the current user
                                 does not have the "list folder" permission
                                 on a directory.  This occurs while operating
                                 recursively (/R) on sub-directories. Valid 
                                 values "Y" to take ownership or "N" to skip.

    /SKIPSL                      Do not follow symbolic links.
                                 Only applicable with /R.

    /?                           Displays this help message.

    NOTE: 1) If /A is not specified, file ownership will be given to the
             current logged on user.

          2) Mixed patterns using "?" and "*" are not supported.

          3) /D is used to suppress the confirmation prompt.

Examples: 
    TAKEOWN /?
    TAKEOWN /F lostfile
    TAKEOWN /F \\system\share\lostfile /A
    TAKEOWN /F directory /R /D N
    TAKEOWN /F directory /R /A
    TAKEOWN /F *
    TAKEOWN /F C:\Windows\System32\acme.exe
    TAKEOWN /F %windir%\*.txt
    TAKEOWN /S system /F MyShare\Acme*.doc
    TAKEOWN /S system /U user /F MyShare\MyBinary.dll
    TAKEOWN /S system /U domain\user /P password /F share\filename
    TAKEOWN /S system /U user /P password /F Doc\Report.doc /A
    TAKEOWN /S system /U user /P password /F Myshare\* 
    TAKEOWN /S system /U user /P password /F Home\Logon /R
    TAKEOWN /S system /U user /P password /F Myshare\directory /R /A

Usage (stderr):

ERROR: Invalid argument/option - '--help'.
Type "TAKEOWN /?" for usage.

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\takeown.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: takeown.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/9ce1d32186f041b669d3ca1afb12dc5f6f7c1ea93267de38c2fd5aa18a04fb0a/detection

Possible Misuse

The following table contains possible examples of takeown.exe being misused. While takeown.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_file_permission_modifications.yml - '\takeown.exe' DRL 1.0
sigma proc_creation_win_susp_takeown.yml title: Suspicious Recursif Takeown DRL 1.0
sigma proc_creation_win_susp_takeown.yml description: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders DRL 1.0
sigma proc_creation_win_susp_takeown.yml - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/takeown DRL 1.0
sigma proc_creation_win_susp_takeown.yml - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility DRL 1.0
sigma proc_creation_win_susp_takeown.yml Image\|endswith: '\takeown.exe' DRL 1.0
malware-ioc oceanlotus-macOS.misp.event.json "https:\/\/docs.microsoft.com\/windows-server\/administration\/windows-commands\/takeown", © ESET 2014-2018
atomic-red-team index.md - Atomic Test #1: Take ownership using takeown utility [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Take ownership using takeown utility [windows] MIT License. © 2018 Red Canary
atomic-red-team T1222.001.md Adversaries can interact with the DACLs using built-in Windows commands, such as icacls, cacls, takeown, and attrib, which can grant adversaries higher permissions on specific files and folders. Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1222.001.md - Atomic Test #1 - Take ownership using takeown utility MIT License. © 2018 Red Canary
atomic-red-team T1222.001.md ## Atomic Test #1 - Take ownership using takeown utility MIT License. © 2018 Red Canary
atomic-red-team T1222.001.md | file_folder_to_own | Path of the file or folder for takeown to take ownership. | Path | %temp%\T1222.001_takeown_folder| MIT License. © 2018 Red Canary
atomic-red-team T1222.001.md takeown.exe /f #{file_folder_to_own} /r MIT License. © 2018 Red Canary
atomic-red-team T1546.008.md takeown /F C:\Windows\System32\sethc.exe /A MIT License. © 2018 Red Canary
signature-base cn_pentestset_scripts.yar $s1 = “success = obj.run("cmd /c takeown /f %SystemRoot%\system32\sethc.exe&echo y| “ ascii /* PEStudio Blacklist: strings */ CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

takeown

Enables an administrator to recover access to a file that previously was denied, by making the administrator the owner of the file. This command is typically used on batch files.

Syntax

takeown [/s <computer> [/u [<domain>\]<username> [/p [<password>]]]] /f <filename> [/a] [/r [/d {Y|N}]]

Parameters

Parameter Description
/s <computer> Specifies the name or IP address of a remote computer (do not use backslashes). The default value is the local computer. This parameter applies to all of the files and folders specified in the command.
/u [<domain>\]<username> Runs the script with the permissions of the specified user account. The default value is system permissions.
/p [<[password>] Specifies the password of the user account that is specified in the /u parameter.
/f <filename> Specifies the file name or directory name pattern. You can use the wildcard character * when specifying the pattern. You can also use the syntax <sharename>\<filename>.
/a Gives ownership to the Administrators group instead of the current user. If you don’t specify this option, file ownership is given to the user who is currently logged on to the computer.
/r Performs a recursive operation on all files in the specified directory and subdirectories.
/d {Y | N} Suppresses the confirmation prompt that is displayed when the current user does not have the List Folder permission on a specified directory, and instead uses the specified default value. Valid values for the /d option are:<ul><li>Y - Take ownership of the directory.</li><li>N - Skip the directory.<p>NOTE
You must use this option in conjunction with the /r option.</li></ul>
/? Displays help at the command prompt.

Remarks

  • Mixed patterns using (? and *) aren’t supported by takeown command.

  • After deleting the lock with takeown, you might have to use Windows Explorer to give yourself full permissions to the files and directories before you can delete them.

Examples

To take ownership of a file named Lostfile, type:

takeown /f lostfile

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.