Move as another logged-on user by stealing their token

Every process carries an access token. With SeDebugPrivilege you can open a process owned by another logged-on user, duplicate its token, and spawn a process in their context, inheriting their network identity for lateral movement.

# enumerate available tokens and their owners
# (Cobalt Strike: steal_token; Meterpreter: incognito list_tokens)
list_tokens -u

Impersonate a higher-value token and reach resources they can access.

impersonate_token "DOM\Administrator"
# now run a command that hits a remote share as that identity
dir \dc01c$

Pro note: a duplicated token uses cached credentials, so it works for network auth without knowing the password, but it dies when the source session logs off. For durable access, pivot the stolen identity into a Kerberos ticket or a credential you can replay later.