privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

Ir para a instalação

Repositório: hypnguyen1209/offensive-claude
Última atividade na origem: 30 de junho de 2026 às 17:50
Idioma detectado do SKILL.md: inglês
Estrelas: 343
Forks: 59

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill privesc-windows

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

12 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

coding-mastery

Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation

2026-06-30

Ver todas deste repositório

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM

Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege

Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member

Service / DLL / scheduled-task misconfiguration hunting on the host

Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)

Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)

Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Automated enumeration (winPEAS/Seatbelt/PrivescCheck)

T1082, T1518

CWE-1188

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

Token-privilege triage + FullPowers recovery

T1134.001

CWE-269

references/enumeration-triage.md

scripts/win_privesc_triage.ps1

SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify)

T1134.001, T1134.002

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Named-pipe / token impersonation primitives

T1134.001

CWE-269

references/token-impersonation-potatoes.md

scripts/check_potato.py

Unquoted service path

T1574.009

CWE-428

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

Weak service ACL / SERVICE_CHANGE_CONFIG

T1543.003

CWE-732

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827)

T1574.001, T1574.010

CWE-427

references/service-dll-hijacking.md

scripts/service_hijack_audit.ps1

UAC bypass — fodhelper/computerdefaults/eventvwr

Technique

Telemetry / IOC

Detection (Sigma / EDR)

OPSEC note

winPEAS/Seatbelt enum

Mass reg/WMI/service queries; winPEAS.exe on disk (heavily AV-flagged)

EDR hacktool sigs on winPEAS/Seatbelt names+hashes

Build Seatbelt yourself; prefer .bat/obfuscated winPEAS or PrivescCheck.ps1 in-memory

Potato (Impersonate)

DCOM/OXID RPC, named-pipe create; SYSTEM child of IIS/MSSQL worker

Sigma win_susp_potato; 4674/4688 child SYSTEM under w3wp/sqlservr

Match the COM/RPC surface left open; PrintNotifyPotato avoids RPC redirector that Defender blocks

Service hijack

7045 service install; sc config binpath change; service binary write

Sigma win_susp_service_path/sc_config; 4697/7045 + new binary hash

Restore original binPath/binary after; stage payload outside C:\Windows

DLL/phantom hijack

Non-MS DLL loaded by SYSTEM process from writable/ProgramData/%PATH% dir

Elastic phantom_dll; Sysmon EID 7 unsigned DLL in odd path

Proxy the real DLL to keep app stable; clean the planted DLL post-exec

UAC bypass

HKCU ms-settings/mscfile shell\open\command writes; fodhelper child cmd

Elastic LUA://HdAutoAp token attr; Sigma fodhelper/eventvwr reg hijack

Use reg symlink + key rename (UACME m3.5+); delete HKCU keys immediately after trigger

Kernel EoP / BYOVD

New 3rd-party .sys load (7045/6); SYSTEM token on low-priv proc; EDR driver unload

Sigma vuln_driver_load; MS Vulnerable Driver Blocklist; ETWTi token-swap

Driver load is loud + persistent — confirm not blocklisted; unload + delete .sys; restore LSTAR/MSR

LSASS dump

Handle to lsass w/ PROCESS_VM_READ/DUP; comsvcs MiniDump cmdline; .dmp on disk

Sysmon EID 10 callstack dbghelp/dbgcore; Splunk comsvcs MiniDump; Elastic PssCaptureSnapshot

Use snapshot/handle-dup + parse off-host; avoid lsass.dmp literal name; clean the dump

SAM/VSS

reg save HKLM\SAM; vssadmin create shadow; GLOBALROOT copies

Sigma reg_save_sam; 8222 VSS; vssadmin process creation

Delete shadow + .bak hives; parse offline with secretsdump LOCAL

DPAPI/vault

Reads of \Microsoft\Protect\* masterkeys + \Credentials\* blobs

EDR access to DPAPI dirs; lsass dpapi:: calls

Decrypt off-host with masterkey/domain backup key; touch only target user's blobs

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

name	privesc-windows
description	Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
metadata	{"type":"offensive","phase":"post-exploitation","tools":"winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump","mitre":"TA0004"}
kill_chain	{"phase":["exploit","actions"],"step":[4,7],"attck_tactics":["TA0004","TA0005","TA0006"],"attck_techniques":["T1134","T1134.001","T1134.002","T1543.003","T1574.001","T1574.009","T1574.010","T1548.002","T1068","T1211","T1003.001","T1003.002","T1555.004","T1053.005","T1547.001"]}
depends_on	["network-attack","exploit-development"]
feeds_into	["red-team-ops","advanced-redteam","active-directory-attack","edr-evasion"]
inputs	["shell_access","os_fingerprint","service_account_context"]
outputs	["elevated_access","system_token","credential_dump","finding_record"]
references	["references/enumeration-triage.md","references/token-impersonation-potatoes.md","references/service-dll-hijacking.md","references/uac-bypass.md","references/kernel-byovd.md","references/credential-harvesting.md"]
scripts	["scripts/win_privesc_triage.ps1","scripts/check_potato.py","scripts/service_hijack_audit.ps1","scripts/uac_bypass.ps1","scripts/byovd_loader.c"]

privesc-windows

Opções de instalação

Revise os arquivos de origem

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

privesc-windows

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

Windows Privilege Escalation

When to Activate

Technique Map

Windows Privilege Escalation

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives