windows-boundaries

Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation

Zur Installation springen

Repository: hypnguyen1209/offensive-claude
Letzte Quellaktivität: 29. Juni 2026 um 07:22
Erkannte Sprache von SKILL.md: Englisch
Sterne: 343
Forks: 59

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill windows-boundaries

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

14 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Alle aus diesem Repository ansehen

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
win32k/dxgkrnl exploit	Bugcheck EID 1001 ref win32k/dxgkrnl; process token flips to S-1-5-18 with no service genealogy	Sigma on bugchecks + token anomaly; ETW Microsoft-Windows-Win32k	Prefer data-only token copy over CFG/CET-fighting control-flow hijack; missed race = loud bugcheck
BYOVD	Sysmon EID 6 driver load from user-writable path; 7045/4697 kernel service; EDR telemetry goes silent	Sigma on unusual driver path + known-bad hashes (loldrivers.io); driver-load-time window	Use un-blocklisted/HVCI-compatible driver; restore LSTAR/callbacks; DeleteService + del .sys
UAC bypass (COM/fodhelper)	Sysmon EID 13 write to HKCU ms-settings\Shell\Open\command; dllhost /Processid:{3E5FC7F9..} spawning shell	Elastic/ManageEngine ICMLuaUtil + fodhelper rules	Rotate to a less-known AutoElevate CLSID; don't spawn cmd from dllhost; clean HKCU tree
Sandbox escape	Renderer/GPU process spawning cmd/powershell/rundll32; Mojo handle-transfer anomalies	Sigma on browser child-process; patch-posture alert (Edge<134.0.3124.93)	Stay in-process post-escape (IPC layer is an EDR blind spot); symlink squat is mostly dead post-2017
PPL bypass	Old keyiso/ncryptprov version loaded in lsass (EID 7); EID 10 lsass read; Cryptography\Providers write; live-dump	Sigma on DLL version-mismatch + GrantedAccess to lsass	Driverless (BYOVDLL/WER/live-dump) avoids BYOVD noise; restore Protection byte; obfuscate dumps
RPC/ALPC impersonation	4624 logon type 9 (Advapi); SYSTEM child of service-acct parent; RPC_S_SERVER_UNAVAILABLE (EID 1)	Elastic named-pipe impersonation rule; ETW RPC + high impersonation level	PhantomRPC endpoint squat blends w/ admin triggers (w32tm/gpupdate); RevertToSelf + close pipe

windows-boundaries

Installationsoptionen

Quelldateien prüfen

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

windows-boundaries

Quellinformationen

Installationsoptionen

Quelldateien prüfen

Mehr aus diesem Repository

Mehr aus diesem Repository

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives