privesc-windows
starsforks
How to install privesc-windows?
hypnguyen1209/offensive-claude/privesc-windows
$npx -y skills add hypnguyen1209/offensive-claude --skill privesc-windowsUse when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
SKILL.md
| 1 | # Windows Privilege Escalation |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM |
| 6 | - Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding `SeImpersonatePrivilege` |
| 7 | - Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member |
| 8 | - Service / DLL / scheduled-task misconfiguration hunting on the host |
| 9 | - Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL) |
| 10 | - Privileged token-right abuse (`SeBackup`/`SeRestore`/`SeTakeOwnership`/`SeLoadDriver`/`SeDebug`) |
| 11 | - Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement |
| 12 | |
| 13 | ## Technique Map |
| 14 | |
| 15 | | Technique | ATT&CK | CWE | Reference | Script | |
| 16 | |-----------|--------|-----|-----------|--------| |
| 17 | | Automated enumeration (winPEAS/Seatbelt/PrivescCheck) | T1082, T1518 | CWE-1188 | references/enumeration-triage.md | scripts/win_privesc_triage.ps1 | |
| 18 | | Token-privilege triage + FullPowers recovery | T1134.001 | CWE-269 | references/enumeration-triage.md | scripts/win_privesc_triage.ps1 | |
| 19 | | SeImpersonate Potato (GodPotato/SigmaPotato/PrintNotify) | T1134.001, T1134.002 | CWE-269 | references/token-impersonation-potatoes.md | scripts/check_potato.py | |
| 20 | | Named-pipe / token impersonation primitives | T1134.001 | CWE-269 | references/token-impersonation-potatoes.md | scripts/check_potato.py | |
| 21 | | Unquoted service path | T1574.009 | CWE-428 | references/service-dll-hijacking.md | scripts/service_hijack_audit.ps1 | |
| 22 | | Weak service ACL / SERVICE_CHANGE_CONFIG | T1543.003 | CWE-732 | references/service-dll-hijacking.md | scripts/service_hijack_audit.ps1 | |
| 23 | | DLL / phantom DLL hijack (CVE-2025-1729, CVE-2024-28827) | T1574.001, T1574.010 | CWE-427 | references/service-dll-hijacking.md | scripts/service_hijack_audit.ps1 | |
| 24 | | UAC bypass — fodhelper/computerdefaults/eventvwr | T1548.002 | CWE-269 | references/uac-bypass.md | scripts/uac_bypass.ps1 | |
| 25 | | UAC bypass — ICMLuaUtil / IEditionUpgradeManager COM | T1548.002 | CWE-269 | references/uac-bypass.md | scripts/uac_bypass.ps1 | |
| 26 | | AlwaysInstallElevated MSI | T1548.002 | CWE-250 | references/uac-bypass.md | scripts/uac_bypass.ps1 | |
| 27 | | Kernel EoP CVE (CLFS CVE-2025-29824/32701; CVE-2025-62215) | T1068 | CWE-416, CWE-362 | references/kernel-byovd.md | scripts/byovd_loader.c | |
| 28 | | BYOVD admin→kernel / EDR-blind (CVE-2025-7771, EDRSandblast) | T1068, T1562.001 | CWE-782 | references/kernel-byovd.md | scripts/byovd_loader.c | |
| 29 | | Privileged token rights (SeBackup/SeRestore/SeLoadDriver/SeDebug) | T1134, T1068 | CWE-269 | references/kernel-byovd.md | scripts/byovd_loader.c | |
| 30 | | LSASS dump (comsvcs / PssCaptureSnapshot / nanodump) | T1003.001 | CWE-522 | references/credential-harvesting.md | - | |
| 31 | | SAM/SYSTEM + VSS offline secretsdump | T1003.002 | CWE-522 | references/credential-harvesting.md | - | |
| 32 | | DPAPI / credential vault / browser secrets | T1555.004, T1555.003 | CWE-522 | references/credential-harvesting.md | - | |
| 33 | |
| 34 | ## Quick Start |
| 35 | |
| 36 | ```powershell |
| 37 | # 0. Identity + token rights — this decides the whole strategy |
| 38 | whoami /priv /groups |
| 39 | powershell -ep bypass -File scripts/win_privesc_triage.ps1 -Quick |
| 40 | |
| 41 | # 1. Full automated enumeration (pick the AV-safest) |
| 42 | .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report pc_%COMPUTERNAME% -Format TXT,HTML |
| 43 | .\Seatbelt.exe -group=all -full # build it yourself; do not trust prebuilt binaries |
| 44 | .\winPEASany_ofs.bat # .bat variant is less AV-flagged than the . |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
