privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

Ir a la instalación

Repositorio: hypnguyen1209/offensive-claude
Última actividad en el origen: 30 de junio de 2026 a las 17:50
Idioma detectado de SKILL.md: inglés
Estrellas: 343
Forks: 59

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill privesc-windows

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

12 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

coding-mastery

Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation

2026-06-30

Ver todos los de este repositorio

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Technique

Telemetry / IOC

Detection (Sigma / EDR)

OPSEC note

winPEAS/Seatbelt enum

Mass reg/WMI/service queries; winPEAS.exe on disk (heavily AV-flagged)

EDR hacktool sigs on winPEAS/Seatbelt names+hashes

Build Seatbelt yourself; prefer .bat/obfuscated winPEAS or PrivescCheck.ps1 in-memory

Potato (Impersonate)

DCOM/OXID RPC, named-pipe create; SYSTEM child of IIS/MSSQL worker

Sigma win_susp_potato; 4674/4688 child SYSTEM under w3wp/sqlservr

Match the COM/RPC surface left open; PrintNotifyPotato avoids RPC redirector that Defender blocks

Service hijack

7045 service install; sc config binpath change; service binary write

Sigma win_susp_service_path/sc_config; 4697/7045 + new binary hash

Restore original binPath/binary after; stage payload outside C:\Windows

DLL/phantom hijack

Non-MS DLL loaded by SYSTEM process from writable/ProgramData/%PATH% dir

Elastic phantom_dll; Sysmon EID 7 unsigned DLL in odd path

Proxy the real DLL to keep app stable; clean the planted DLL post-exec

UAC bypass

HKCU ms-settings/mscfile shell\open\command writes; fodhelper child cmd

Elastic LUA://HdAutoAp token attr; Sigma fodhelper/eventvwr reg hijack

Use reg symlink + key rename (UACME m3.5+); delete HKCU keys immediately after trigger

Kernel EoP / BYOVD

New 3rd-party .sys load (7045/6); SYSTEM token on low-priv proc; EDR driver unload

Sigma vuln_driver_load; MS Vulnerable Driver Blocklist; ETWTi token-swap

Driver load is loud + persistent — confirm not blocklisted; unload + delete .sys; restore LSTAR/MSR

LSASS dump

Handle to lsass w/ PROCESS_VM_READ/DUP; comsvcs MiniDump cmdline; .dmp on disk

Sysmon EID 10 callstack dbghelp/dbgcore; Splunk comsvcs MiniDump; Elastic PssCaptureSnapshot

Use snapshot/handle-dup + parse off-host; avoid lsass.dmp literal name; clean the dump

SAM/VSS

reg save HKLM\SAM; vssadmin create shadow; GLOBALROOT copies

Sigma reg_save_sam; 8222 VSS; vssadmin process creation

Delete shadow + .bak hives; parse offline with secretsdump LOCAL

DPAPI/vault

Reads of \Microsoft\Protect\* masterkeys + \Credentials\* blobs

EDR access to DPAPI dirs; lsass dpapi:: calls

Decrypt off-host with masterkey/domain backup key; touch only target user's blobs

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

privesc-windows

Opciones de instalación

Revisa los archivos de origen

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

privesc-windows

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives