windows-boundaries

Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation

Aller à l'installation

Dépôt: hypnguyen1209/offensive-claude
Dernière activité de la source: 29 juin 2026 à 07:22
Langue détectée de SKILL.md: anglais
Étoiles: 343
Forks: 59

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill windows-boundaries

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

14 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
win32k/dxgkrnl exploit	Bugcheck EID 1001 ref win32k/dxgkrnl; process token flips to S-1-5-18 with no service genealogy	Sigma on bugchecks + token anomaly; ETW Microsoft-Windows-Win32k	Prefer data-only token copy over CFG/CET-fighting control-flow hijack; missed race = loud bugcheck
BYOVD	Sysmon EID 6 driver load from user-writable path; 7045/4697 kernel service; EDR telemetry goes silent	Sigma on unusual driver path + known-bad hashes (loldrivers.io); driver-load-time window	Use un-blocklisted/HVCI-compatible driver; restore LSTAR/callbacks; DeleteService + del .sys
UAC bypass (COM/fodhelper)	Sysmon EID 13 write to HKCU ms-settings\Shell\Open\command; dllhost /Processid:{3E5FC7F9..} spawning shell	Elastic/ManageEngine ICMLuaUtil + fodhelper rules	Rotate to a less-known AutoElevate CLSID; don't spawn cmd from dllhost; clean HKCU tree
Sandbox escape	Renderer/GPU process spawning cmd/powershell/rundll32; Mojo handle-transfer anomalies	Sigma on browser child-process; patch-posture alert (Edge<134.0.3124.93)	Stay in-process post-escape (IPC layer is an EDR blind spot); symlink squat is mostly dead post-2017
PPL bypass	Old keyiso/ncryptprov version loaded in lsass (EID 7); EID 10 lsass read; Cryptography\Providers write; live-dump	Sigma on DLL version-mismatch + GrantedAccess to lsass	Driverless (BYOVDLL/WER/live-dump) avoids BYOVD noise; restore Protection byte; obfuscate dumps
RPC/ALPC impersonation	4624 logon type 9 (Advapi); SYSTEM child of service-acct parent; RPC_S_SERVER_UNAVAILABLE (EID 1)	Elastic named-pipe impersonation rule; ETW RPC + high impersonation level	PhantomRPC endpoint squat blends w/ admin triggers (w32tm/gpupdate); RevertToSelf + close pipe

windows-boundaries

Options d'installation

Vérifiez les fichiers source

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

windows-boundaries

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives