privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 30, 2026 at 17:50
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill privesc-windows

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

12 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Technique

Telemetry / IOC

Detection (Sigma / EDR)

OPSEC note

winPEAS/Seatbelt enum

Mass reg/WMI/service queries; winPEAS.exe on disk (heavily AV-flagged)

EDR hacktool sigs on winPEAS/Seatbelt names+hashes

Build Seatbelt yourself; prefer .bat/obfuscated winPEAS or PrivescCheck.ps1 in-memory

Potato (Impersonate)

DCOM/OXID RPC, named-pipe create; SYSTEM child of IIS/MSSQL worker

Sigma win_susp_potato; 4674/4688 child SYSTEM under w3wp/sqlservr

Match the COM/RPC surface left open; PrintNotifyPotato avoids RPC redirector that Defender blocks

Service hijack

7045 service install; sc config binpath change; service binary write

Sigma win_susp_service_path/sc_config; 4697/7045 + new binary hash

Restore original binPath/binary after; stage payload outside C:\Windows

DLL/phantom hijack

Non-MS DLL loaded by SYSTEM process from writable/ProgramData/%PATH% dir

Elastic phantom_dll; Sysmon EID 7 unsigned DLL in odd path

Proxy the real DLL to keep app stable; clean the planted DLL post-exec

UAC bypass

HKCU ms-settings/mscfile shell\open\command writes; fodhelper child cmd

Elastic LUA://HdAutoAp token attr; Sigma fodhelper/eventvwr reg hijack

Use reg symlink + key rename (UACME m3.5+); delete HKCU keys immediately after trigger

Kernel EoP / BYOVD

New 3rd-party .sys load (7045/6); SYSTEM token on low-priv proc; EDR driver unload

Sigma vuln_driver_load; MS Vulnerable Driver Blocklist; ETWTi token-swap

Driver load is loud + persistent — confirm not blocklisted; unload + delete .sys; restore LSTAR/MSR

LSASS dump

Handle to lsass w/ PROCESS_VM_READ/DUP; comsvcs MiniDump cmdline; .dmp on disk

Sysmon EID 10 callstack dbghelp/dbgcore; Splunk comsvcs MiniDump; Elastic PssCaptureSnapshot

Use snapshot/handle-dup + parse off-host; avoid lsass.dmp literal name; clean the dump

SAM/VSS

reg save HKLM\SAM; vssadmin create shadow; GLOBALROOT copies

Sigma reg_save_sam; 8222 VSS; vssadmin process creation

Delete shadow + .bak hives; parse offline with secretsdump LOCAL

DPAPI/vault

Reads of \Microsoft\Protect\* masterkeys + \Credentials\* blobs

EDR access to DPAPI dirs; lsass dpapi:: calls

Decrypt off-host with masterkey/domain backup key; touch only target user's blobs

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

privesc-windows

Install options

Review the source files

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

privesc-windows

Source facts

Install options

Review the source files

More from this repository

More from this repository

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives