windows-boundaries

Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation

Ir para a instalação

Repositório: hypnguyen1209/offensive-claude
Última atividade na origem: 29 de junho de 2026 às 07:22
Idioma detectado do SKILL.md: inglês
Estrelas: 343
Forks: 59

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill windows-boundaries

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

14 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Ver todas deste repositório

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)

Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers

Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive

Defeating PPL to dump LSASS or tamper with EDR self-defense

Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse

UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Technique Map

Technique

ATT&CK

CWE

Reference

Script

win32k / dxgkrnl UAF → kernel R/W → token steal

T1068

CWE-416

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

Driver IOCTL abuse (METHOD_NEITHER arb-R/W)

T1068

CWE-781

references/kernel-user-boundary.md

scripts/ioctl_fuzzer.py

BYOVD load + MSR/LSTAR or phys R/W → SYSTEM

T1068, T1543.003

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

BYOVD EDR-kill (callback nulling)

T1562.001, T1014

CWE-1188

references/byovd-kernel-rw.md

scripts/byovd_kernel_rw.c

UAC bypass — ICMLuaUtil elevated COM moniker

T1548.002

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

UAC bypass — fodhelper HKCU registry hijack

T1548.002, T1112

CWE-269

references/integrity-uac-com.md

scripts/uac_com_elevate.cpp

AppContainer/LPAC broker abuse / cap over-grant

T1211

CWE-668

references/sandbox-appcontainer-escape.md

scripts/sandbox_escape_probe.py

Chromium/Edge Mojo IPC sandbox escape

T1211

CWE-501

references/sandbox-appcontainer-escape.md

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

name	windows-boundaries
description	Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
metadata	{"type":"offensive","phase":"exploitation","tools":"WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon","mitre":"TA0004"}
kill_chain	{"phase":["exploit","install"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1068","T1211","T1548.002","T1134.001","T1134.002","T1543.003","T1559","T1112","T1003.001","T1014"]}
depends_on	["privesc-windows","exploit-development"]
feeds_into	["red-team-ops","edr-evasion"]
inputs	["sandbox_config","kernel_info","foothold_token"]
outputs	["boundary_escape","elevated_access","kernel_rw_primitive","system_token"]
references	["references/kernel-user-boundary.md","references/byovd-kernel-rw.md","references/integrity-uac-com.md","references/sandbox-appcontainer-escape.md","references/ppl-protected-process.md","references/rpc-alpc-boundary.md"]
scripts	["scripts/enum_boundaries.ps1","scripts/ioctl_fuzzer.py","scripts/byovd_kernel_rw.c","scripts/uac_com_elevate.cpp","scripts/sandbox_escape_probe.py","scripts/ppl_byovdll.c","scripts/named_pipe_impersonate.c"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
win32k/dxgkrnl exploit	Bugcheck EID 1001 ref win32k/dxgkrnl; process token flips to S-1-5-18 with no service genealogy	Sigma on bugchecks + token anomaly; ETW Microsoft-Windows-Win32k	Prefer data-only token copy over CFG/CET-fighting control-flow hijack; missed race = loud bugcheck
BYOVD	Sysmon EID 6 driver load from user-writable path; 7045/4697 kernel service; EDR telemetry goes silent	Sigma on unusual driver path + known-bad hashes (loldrivers.io); driver-load-time window	Use un-blocklisted/HVCI-compatible driver; restore LSTAR/callbacks; DeleteService + del .sys
UAC bypass (COM/fodhelper)	Sysmon EID 13 write to HKCU ms-settings\Shell\Open\command; dllhost /Processid:{3E5FC7F9..} spawning shell	Elastic/ManageEngine ICMLuaUtil + fodhelper rules	Rotate to a less-known AutoElevate CLSID; don't spawn cmd from dllhost; clean HKCU tree
Sandbox escape	Renderer/GPU process spawning cmd/powershell/rundll32; Mojo handle-transfer anomalies	Sigma on browser child-process; patch-posture alert (Edge<134.0.3124.93)	Stay in-process post-escape (IPC layer is an EDR blind spot); symlink squat is mostly dead post-2017
PPL bypass	Old keyiso/ncryptprov version loaded in lsass (EID 7); EID 10 lsass read; Cryptography\Providers write; live-dump	Sigma on DLL version-mismatch + GrantedAccess to lsass	Driverless (BYOVDLL/WER/live-dump) avoids BYOVD noise; restore Protection byte; obfuscate dumps
RPC/ALPC impersonation	4624 logon type 9 (Advapi); SYSTEM child of service-acct parent; RPC_S_SERVER_UNAVAILABLE (EID 1)	Elastic named-pipe impersonation rule; ETW RPC + high impersonation level	PhantomRPC endpoint squat blends w/ admin triggers (w32tm/gpupdate); RevertToSelf + close pipe

windows-boundaries

Opções de instalação

Revise os arquivos de origem

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

windows-boundaries

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Mais deste repositório

Windows Security Boundaries

When to Activate

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives