takeown.exe
- File Path:
C:\windows\SysWOW64\takeown.exe - Description: Takes ownership of a file
Hashes
| Type | Hash |
|---|---|
| MD5 | 71F454FDDC36732FA5E0AC6B518DF41F |
| SHA1 | 53826412BE30AC056784BD41F8B0622C040FA251 |
| SHA256 | F844A4A3E020FE064218D65A0F26B2DB28A3D92FF10077FDE023454D3ADC8510 |
| SHA384 | 5E92D6ECCF81E4EE1F059A75F5B20FA2AD1A1FCFCBEE088CA7260075D466F22BEF490497F3FE5A432E1703D2C0E8845E |
| SHA512 | 0B62796D9B3B79FD14AF96372CCDBBB7A1D95AD8833B42444E8DA49EABF564C47CDA1BF8489872190BC4C7DDC5EDF0022B414DB105E09FCB218FB593B499A668 |
| SSDEEP | 768:b3WdLtIMgAR8rJoxkqHsZIZS7l7I70WijBGE/YGmWf0hZ05TNm6GlyQXsxJLD6PZ:b3WMZNJhH7I7wb/YQM0VQLyQXsxJn6x |
Signature
- Status: The file C:\windows\SysWOW64\takeown.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
- Serial: ``
- Thumbprint: ``
- Issuer:
- Subject:
File Metadata
- Original Filename: takeown.exe.mui
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
- Product Version: 6.3.9600.16384
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
Possible Misuse
The following table contains possible examples of takeown.exe being misused. While takeown.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | proc_creation_win_file_permission_modifications.yml | - '\takeown.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_takeown.yml | title: Suspicious Recursif Takeown |
DRL 1.0 |
| sigma | proc_creation_win_susp_takeown.yml | description: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders |
DRL 1.0 |
| sigma | proc_creation_win_susp_takeown.yml | - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/takeown |
DRL 1.0 |
| sigma | proc_creation_win_susp_takeown.yml | - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility |
DRL 1.0 |
| sigma | proc_creation_win_susp_takeown.yml | Image\|endswith: '\takeown.exe' |
DRL 1.0 |
| malware-ioc | oceanlotus-macOS.misp.event.json | "https:\/\/docs.microsoft.com\/windows-server\/administration\/windows-commands\/takeown", |
© ESET 2014-2018 |
| atomic-red-team | index.md | - Atomic Test #1: Take ownership using takeown utility [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | windows-index.md | - Atomic Test #1: Take ownership using takeown utility [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | T1222.001.md | Adversaries can interact with the DACLs using built-in Windows commands, such as icacls, cacls, takeown, and attrib, which can grant adversaries higher permissions on specific files and folders. Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.</blockquote> |
MIT License. © 2018 Red Canary |
| atomic-red-team | T1222.001.md | - Atomic Test #1 - Take ownership using takeown utility | MIT License. © 2018 Red Canary |
| atomic-red-team | T1222.001.md | ## Atomic Test #1 - Take ownership using takeown utility | MIT License. © 2018 Red Canary |
| atomic-red-team | T1222.001.md | | file_folder_to_own | Path of the file or folder for takeown to take ownership. | Path | %temp%\T1222.001_takeown_folder| | MIT License. © 2018 Red Canary |
| atomic-red-team | T1222.001.md | takeown.exe /f #{file_folder_to_own} /r | MIT License. © 2018 Red Canary |
| atomic-red-team | T1546.008.md | takeown /F C:\Windows\System32\sethc.exe /A | MIT License. © 2018 Red Canary |
| signature-base | cn_pentestset_scripts.yar | $s1 = “success = obj.run("cmd /c takeown /f %SystemRoot%\system32\sethc.exe&echo y| “ ascii /* PEStudio Blacklist: strings */ | CC BY-NC 4.0 |
Additional Info*
*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.
takeown
Enables an administrator to recover access to a file that previously was denied, by making the administrator the owner of the file. This command is typically used on batch files.
Syntax
takeown [/s <computer> [/u [<domain>\]<username> [/p [<password>]]]] /f <filename> [/a] [/r [/d {Y|N}]]
Parameters
| Parameter | Description |
|---|---|
/s <computer> |
Specifies the name or IP address of a remote computer (do not use backslashes). The default value is the local computer. This parameter applies to all of the files and folders specified in the command. |
/u [<domain>\]<username> |
Runs the script with the permissions of the specified user account. The default value is system permissions. |
/p [<[password>] |
Specifies the password of the user account that is specified in the /u parameter. |
/f <filename> |
Specifies the file name or directory name pattern. You can use the wildcard character * when specifying the pattern. You can also use the syntax <sharename>\<filename>. |
| /a | Gives ownership to the Administrators group instead of the current user. If you don’t specify this option, file ownership is given to the user who is currently logged on to the computer. |
| /r | Performs a recursive operation on all files in the specified directory and subdirectories. |
/d {Y | N} |
Suppresses the confirmation prompt that is displayed when the current user does not have the List Folder permission on a specified directory, and instead uses the specified default value. Valid values for the /d option are:<ul><li>Y - Take ownership of the directory.</li><li>N - Skip the directory.<p>NOTE You must use this option in conjunction with the /r option.</li></ul> |
| /? | Displays help at the command prompt. |
Remarks
-
Mixed patterns using (? and *) aren’t supported by takeown command.
-
After deleting the lock with takeown, you might have to use Windows Explorer to give yourself full permissions to the files and directories before you can delete them.
Examples
To take ownership of a file named Lostfile, type:
takeown /f lostfile
Additional References
MIT License. Copyright (c) 2020-2021 Strontic.