windows-boundaries

Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill windows-boundaries

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

14 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
win32k/dxgkrnl exploit	Bugcheck EID 1001 ref win32k/dxgkrnl; process token flips to S-1-5-18 with no service genealogy	Sigma on bugchecks + token anomaly; ETW Microsoft-Windows-Win32k	Prefer data-only token copy over CFG/CET-fighting control-flow hijack; missed race = loud bugcheck
BYOVD	Sysmon EID 6 driver load from user-writable path; 7045/4697 kernel service; EDR telemetry goes silent	Sigma on unusual driver path + known-bad hashes (loldrivers.io); driver-load-time window	Use un-blocklisted/HVCI-compatible driver; restore LSTAR/callbacks; DeleteService + del .sys
UAC bypass (COM/fodhelper)	Sysmon EID 13 write to HKCU ms-settings\Shell\Open\command; dllhost /Processid:{3E5FC7F9..} spawning shell	Elastic/ManageEngine ICMLuaUtil + fodhelper rules	Rotate to a less-known AutoElevate CLSID; don't spawn cmd from dllhost; clean HKCU tree
Sandbox escape	Renderer/GPU process spawning cmd/powershell/rundll32; Mojo handle-transfer anomalies	Sigma on browser child-process; patch-posture alert (Edge<134.0.3124.93)	Stay in-process post-escape (IPC layer is an EDR blind spot); symlink squat is mostly dead post-2017
PPL bypass	Old keyiso/ncryptprov version loaded in lsass (EID 7); EID 10 lsass read; Cryptography\Providers write; live-dump	Sigma on DLL version-mismatch + GrantedAccess to lsass	Driverless (BYOVDLL/WER/live-dump) avoids BYOVD noise; restore Protection byte; obfuscate dumps
RPC/ALPC impersonation	4624 logon type 9 (Advapi); SYSTEM child of service-acct parent; RPC_S_SERVER_UNAVAILABLE (EID 1)	Elastic named-pipe impersonation rule; ETW RPC + high impersonation level	PhantomRPC endpoint squat blends w/ admin triggers (w32tm/gpupdate); RevertToSelf + close pipe

windows-boundaries

Install options

Review the source files

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

windows-boundaries

Source facts

Install options

Review the source files

More from this repository

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

More from this repository