windows-boundaries
starsforks
How to install windows-boundaries?
hypnguyen1209/offensive-claude/windows-boundaries
$npx -y skills add hypnguyen1209/offensive-claude --skill windows-boundariesUse when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation
SKILL.md
| 1 | # Windows Security Boundaries |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Planning a privilege-escalation path that crosses a Windows security boundary |
| 6 | (integrity level, AppContainer/LPAC, PPL, or the kernel/user line) |
| 7 | - Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged |
| 8 | apps, AppContainer/LPAC brokers |
| 9 | - Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive |
| 10 | - Defeating PPL to dump LSASS or tamper with EDR self-defense |
| 11 | - Going from a `SeImpersonate` service account to SYSTEM via RPC/ALPC/named-pipe abuse |
| 12 | - UAC bypass (Medium → High) via auto-elevating COM or registry hijack |
| 13 | |
| 14 | ## Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM. |
| 15 | |
| 16 | ## Technique Map |
| 17 | |
| 18 | | Technique | ATT&CK | CWE | Reference | Script | |
| 19 | |-----------|--------|-----|-----------|--------| |
| 20 | | win32k / dxgkrnl UAF → kernel R/W → token steal | T1068 | CWE-416 | references/kernel-user-boundary.md | scripts/ioctl_fuzzer.py | |
| 21 | | Driver IOCTL abuse (METHOD_NEITHER arb-R/W) | T1068 | CWE-781 | references/kernel-user-boundary.md | scripts/ioctl_fuzzer.py | |
| 22 | | BYOVD load + MSR/LSTAR or phys R/W → SYSTEM | T1068, T1543.003 | CWE-1188 | references/byovd-kernel-rw.md | scripts/byovd_kernel_rw.c | |
| 23 | | BYOVD EDR-kill (callback nulling) | T1562.001, T1014 | CWE-1188 | references/byovd-kernel-rw.md | scripts/byovd_kernel_rw.c | |
| 24 | | UAC bypass — ICMLuaUtil elevated COM moniker | T1548.002 | CWE-269 | references/integrity-uac-com.md | scripts/uac_com_elevate.cpp | |
| 25 | | UAC bypass — fodhelper HKCU registry hijack | T1548.002, T1112 | CWE-269 | references/integrity-uac-com.md | scripts/uac_com_elevate.cpp | |
| 26 | | AppContainer/LPAC broker abuse / cap over-grant | T1211 | CWE-668 | references/sandbox-appcontainer-escape.md | scripts/sandbox_escape_probe.py | |
| 27 | | Chromium/Edge Mojo IPC sandbox escape | T1211 | CWE-501 | references/sandbox-appcontainer-escape.md | scripts/sandbox_escape_probe.py | |
| 28 | | Named-object / symbolic-link squatting | T1211 | CWE-59 | references/sandbox-appcontainer-escape.md | scripts/sandbox_escape_probe.py | |
| 29 | | PPL bypass — BYOVDLL (old signed DLL into PPL) | T1003.001, T1211 | CWE-426 | references/ppl-protected-process.md | scripts/ppl_byovdll.c | |
| 30 | | PPL bypass — live-dump / WER / Protection-clear | T1003.001, T1562.001 | CWE-269 | references/ppl-protected-process.md | scripts/byovd_kernel_rw.c | |
| 31 | | RPC server spoof / endpoint squat (PhantomRPC) | T1559, T1134.001 | CWE-287 | references/rpc-alpc-boundary.md | scripts/named_pipe_impersonate.c | |
| 32 | | Named-pipe client impersonation (Potato family) | T1134.002, T1134.001 | CWE-294 | references/rpc-alpc-boundary.md | scripts/named_pipe_impersonate.c | |
| 33 | | Host boundary posture enumeration | T1082 | CWE-693 | (all) | scripts/enum_boundaries.ps1 | |
| 34 | |
| 35 | ## Quick Start |
| 36 | |
| 37 | ```cmd |
| 38 | :: 0. Map the host's boundary posture -> pick the right primitive |
| 39 | powershell -ep bypass -File scripts/enum_boundaries.ps1 |
| 40 | :: reports: integrity, AppContainer, SeImpersonate/SeDebug, HVCI, driver blocklist, |
| 41 | :: LSASS RunAsPPL, drivers loaded from user-writable paths, named-pipe count. |
| 42 | |
| 43 | :: 1. From a sandbox (renderer/packaged app): rank escape vectors |
| 44 | python scripts/sandbox_escape_probe.py |
| 45 | |
| 46 | :: 2. Medium -> High: UAC bypass (no file dropped via COM moniker) |
| 47 | uac_com_elevate.exe com "C:\Windows\System32\cmd.exe /c whoami /groups > C:\poc.txt" |
| 48 | |
| 49 | :: 3. SeImpersonate present -> SYSTEM via PhantomRPC endpoint squat |
| 50 | whoami /priv | findstr SeImpersonate |
| 51 | named_pipe_impersonate. |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
