privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

Aller à l'installation

Dépôt: hypnguyen1209/offensive-claude
Dernière activité de la source: 30 juin 2026 à 17:50
Langue détectée de SKILL.md: anglais
Étoiles: 343
Forks: 59

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill privesc-windows

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

12 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

coding-mastery

Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation

2026-06-30

Tout voir dans ce dépôt

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Technique

Telemetry / IOC

Detection (Sigma / EDR)

OPSEC note

winPEAS/Seatbelt enum

Mass reg/WMI/service queries; winPEAS.exe on disk (heavily AV-flagged)

EDR hacktool sigs on winPEAS/Seatbelt names+hashes

Build Seatbelt yourself; prefer .bat/obfuscated winPEAS or PrivescCheck.ps1 in-memory

Potato (Impersonate)

DCOM/OXID RPC, named-pipe create; SYSTEM child of IIS/MSSQL worker

Sigma win_susp_potato; 4674/4688 child SYSTEM under w3wp/sqlservr

Match the COM/RPC surface left open; PrintNotifyPotato avoids RPC redirector that Defender blocks

Service hijack

7045 service install; sc config binpath change; service binary write

Sigma win_susp_service_path/sc_config; 4697/7045 + new binary hash

Restore original binPath/binary after; stage payload outside C:\Windows

DLL/phantom hijack

Non-MS DLL loaded by SYSTEM process from writable/ProgramData/%PATH% dir

Elastic phantom_dll; Sysmon EID 7 unsigned DLL in odd path

Proxy the real DLL to keep app stable; clean the planted DLL post-exec

UAC bypass

HKCU ms-settings/mscfile shell\open\command writes; fodhelper child cmd

Elastic LUA://HdAutoAp token attr; Sigma fodhelper/eventvwr reg hijack

Use reg symlink + key rename (UACME m3.5+); delete HKCU keys immediately after trigger

Kernel EoP / BYOVD

New 3rd-party .sys load (7045/6); SYSTEM token on low-priv proc; EDR driver unload

Sigma vuln_driver_load; MS Vulnerable Driver Blocklist; ETWTi token-swap

Driver load is loud + persistent — confirm not blocklisted; unload + delete .sys; restore LSTAR/MSR

LSASS dump

Handle to lsass w/ PROCESS_VM_READ/DUP; comsvcs MiniDump cmdline; .dmp on disk

Sysmon EID 10 callstack dbghelp/dbgcore; Splunk comsvcs MiniDump; Elastic PssCaptureSnapshot

Use snapshot/handle-dup + parse off-host; avoid lsass.dmp literal name; clean the dump

SAM/VSS

reg save HKLM\SAM; vssadmin create shadow; GLOBALROOT copies

Sigma reg_save_sam; 8222 VSS; vssadmin process creation

Delete shadow + .bak hives; parse offline with secretsdump LOCAL

DPAPI/vault

Reads of \Microsoft\Protect\* masterkeys + \Credentials\* blobs

EDR access to DPAPI dirs; lsass dpapi:: calls

Decrypt off-host with masterkey/domain backup key; touch only target user's blobs

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

privesc-windows

Options d'installation

Vérifiez les fichiers source

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

privesc-windows

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Windows Privilege Escalation

When to Activate

Technique Map

Plus depuis ce dépôt

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives