privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

Zur Installation springen

Repository: hypnguyen1209/offensive-claude
Letzte Quellaktivität: 30. Juni 2026 um 17:50
Erkannte Sprache von SKILL.md: Englisch
Sterne: 343
Forks: 59

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill privesc-windows

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

12 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

coding-mastery

Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation

2026-06-30

Alle aus diesem Repository ansehen

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Technique

Telemetry / IOC

Detection (Sigma / EDR)

OPSEC note

winPEAS/Seatbelt enum

Mass reg/WMI/service queries; winPEAS.exe on disk (heavily AV-flagged)

EDR hacktool sigs on winPEAS/Seatbelt names+hashes

Build Seatbelt yourself; prefer .bat/obfuscated winPEAS or PrivescCheck.ps1 in-memory

Potato (Impersonate)

DCOM/OXID RPC, named-pipe create; SYSTEM child of IIS/MSSQL worker

Sigma win_susp_potato; 4674/4688 child SYSTEM under w3wp/sqlservr

Match the COM/RPC surface left open; PrintNotifyPotato avoids RPC redirector that Defender blocks

Service hijack

7045 service install; sc config binpath change; service binary write

Sigma win_susp_service_path/sc_config; 4697/7045 + new binary hash

Restore original binPath/binary after; stage payload outside C:\Windows

DLL/phantom hijack

Non-MS DLL loaded by SYSTEM process from writable/ProgramData/%PATH% dir

Elastic phantom_dll; Sysmon EID 7 unsigned DLL in odd path

Proxy the real DLL to keep app stable; clean the planted DLL post-exec

UAC bypass

HKCU ms-settings/mscfile shell\open\command writes; fodhelper child cmd

Elastic LUA://HdAutoAp token attr; Sigma fodhelper/eventvwr reg hijack

Use reg symlink + key rename (UACME m3.5+); delete HKCU keys immediately after trigger

Kernel EoP / BYOVD

New 3rd-party .sys load (7045/6); SYSTEM token on low-priv proc; EDR driver unload

Sigma vuln_driver_load; MS Vulnerable Driver Blocklist; ETWTi token-swap

Driver load is loud + persistent — confirm not blocklisted; unload + delete .sys; restore LSTAR/MSR

LSASS dump

Handle to lsass w/ PROCESS_VM_READ/DUP; comsvcs MiniDump cmdline; .dmp on disk

Sysmon EID 10 callstack dbghelp/dbgcore; Splunk comsvcs MiniDump; Elastic PssCaptureSnapshot

Use snapshot/handle-dup + parse off-host; avoid lsass.dmp literal name; clean the dump

SAM/VSS

reg save HKLM\SAM; vssadmin create shadow; GLOBALROOT copies

Sigma reg_save_sam; 8222 VSS; vssadmin process creation

Delete shadow + .bak hives; parse offline with secretsdump LOCAL

DPAPI/vault

Reads of \Microsoft\Protect\* masterkeys + \Credentials\* blobs

EDR access to DPAPI dirs; lsass dpapi:: calls

Decrypt off-host with masterkey/domain backup key; touch only target user's blobs

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

privesc-windows

Installationsoptionen

Quelldateien prüfen

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

privesc-windows

Quellinformationen

Installationsoptionen

Quelldateien prüfen

Mehr aus diesem Repository

Windows Privilege Escalation

When to Activate

Technique Map

Mehr aus diesem Repository

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives