offensive-windows-mitigations

Name: offensive-windows-mitigations
Author: SnailSploit

2.8kstars447forks

How to install offensive-windows-mitigations?

snailsploit/claude-red/offensive-windows-mitigations

$npx -y skills add SnailSploit/Claude-Red --skill offensive-windows-mitigations

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Week 6: Understanding Windows Mitigations
2
3	## Metadata
4	- Skill Name: windows-mitigations
5	- Folder: offensive-windows-mitigations
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/6-windows-mitigations.md
7
8	## Description
9	Deep-dive on Windows exploit mitigations: ASLR, DEP/NX, CFG, CET/Shadow Stack, SEHOP, Heap Guard, ACG, Arbitrary Code Guard. Covers both the protection mechanism and known bypass techniques. Use when researching Windows exploit mitigations, planning bypass strategies, or understanding protection depth.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`Windows mitigations, ASLR, DEP, NX, CFG, CET, shadow stack, SEHOP, heap guard, ACG, mitigation bypass, exploit mitigation, Windows hardening`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Week 6: Understanding Windows Mitigations
29
30	## Overview
31
32	_created by AnotherOne from @Pwn3rzs Telegram channel_.
33
34	Last week you learned basic exploitation in an environment without protections.
35	This week, you'll learn about the defensive mechanisms that modern Windows systems employ to prevent those attacks.
36	Understanding these mitigations is essential before learning to bypass them (Week 8). Week 7 continues with enterprise security topics (offensive reconnaissance, Windows 11 24H2/25H2 mitigations, cross-platform defenses).
37
38	This Week's Focus:
39
40	- Understand how each mitigation works
41	- Learn to detect active mitigations
42	- Verify mitigation effectiveness
43	- Test exploits against protected binaries
44	- Prepare for Week 7's boundaries and Week 8's bypass techniques
45
46	### Prerequisites
47
48	Before starting this week, ensure you have:
49
50	- Completed Week 5: Basic Exploitation (Linux) - you should be able to exploit stack overflows, build ROP chains, and use pwntools
51	- A Windows 11 VM (isolated, snapshot before each exercise)
52	- Visual Studio 2022 Build Tools installed
53	- WinDbg Preview installed
54	- Basic familiarity with x64 assembly and calling conventions
55
56	### Week 6 Deliverables
57
58	By the end of this week, you should have completed the following:
59
60	- [ ] Lab Environment: Windows 11 VM with Visual Studio Build Tools, WinDbg Preview, and Sysinternals installed
61	- [ ] Test Binaries: Compiled `vulnerable_suite_win_mitigated.c` and `vuln_server_win.c` with various mitigation flags
62	- [ ] DEP Verified: Demonstrated DEP blocking shellcode execution with crash analysis (Exception Code 0xC0000005, Param 8)
63	- [ ] ASLR Measured: Recorded addresses of `check_aslr.exe` across 3 reboots and documented randomization behavior
64	- [ ] Stack Cookie Tested: Triggered `/GS` cookie check failure and analyzed in WinDbg
65	- [ ] CFG Validated: Demonstrated CFG blocking indirect call to invalid target
66	- [ ] Crash Dumps Analyzed: Created at least 3 crash dumps and identified which mitigation caused each termination using `!analyze -v`
67	- [ ] Week 5 Exploit Retesting: Re-ran Week 5 exploits against mitigated binaries and documented failures
68	- [ ] Mitigation Audit Report: Generated system-wide and per-binary mitigation audit using PowerShell scripts
69	- [ ] Hardening Capstone: Completed the SecureServer v1.0 hardening exercise (Day 7)
70
71	### Context
72
73	Why Mitigations Matter: Modern exploits chain multiple vulnerabilities and bypass layers of protection. Understanding mitigations helps you:
74
75	- Recognize when an exploit is blocked vs. when it succeeds
76	- Analyze crash dumps to identify exploitation attempts
77	- Design defense-in-depth strategies
78	- Prepare for Weeks 7-8 (advanced mitigations and bypass techniques)
79
80	Recent CVEs Demonstrating Mitigation Importance:
81
82	\| CVE \| Vulnerability \| Mitigations Involved \| Outcome \|
83	\| -------------- \| ------------------------------- \| -------------------- \| ------------------------------------- \|
84	\| CVE-2024-21338 \| AppLocker (appid.sys) EoP \| KASLR, SMEP, kCFG \| Admin-to-Kernel bypass of kCFG \|
85	\| CVE-2024-30088 \| Authz Kernel TOCTOU \| KASLR, SMEP, CFG \| Exploited via race condition \|
86	\| CVE-2023-36802 \| MSKSSRV Object Type Confusion \| KASLR, SMEP, CFG \| Pool spray + type confusion to EoP \|
87	\| CVE-2025-29824 \| CLFS Driver Use-After-Free \| KASLR, SMEP \| Zero-day exploited in wild (Apr 2025) \|
88	\| CVE-2024-49138 \| CLFS Heap-Based Buffer Overflow \| DEP, ASLR, KASLR \| EoP exploited in wild (Dec 2024) \|
89	\| CVE-2023-32019 \| Windows Kernel Info Disclosure \| KASLR \| Leaked kernel memory bypassing KASLR \|
90	\| CVE-2023-28252 \| CLFS Driver EoP \| KASLR, SMEP \| Abused CLFS log file parsi

People who liked this also viewed

6 picks

Type

offensive-windows-mitigations

2.8kstars447forks

View on GitHub

How to install offensive-windows-mitigations?

snailsploit/claude-red/offensive-windows-mitigations

$npx -y skills add SnailSploit/Claude-Red --skill offensive-windows-mitigations

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Week 6: Understanding Windows Mitigations
2
3	## Metadata
4	- Skill Name: windows-mitigations
5	- Folder: offensive-windows-mitigations
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/6-windows-mitigations.md
7
8	## Description
9	Deep-dive on Windows exploit mitigations: ASLR, DEP/NX, CFG, CET/Shadow Stack, SEHOP, Heap Guard, ACG, Arbitrary Code Guard. Covers both the protection mechanism and known bypass techniques. Use when researching Windows exploit mitigations, planning bypass strategies, or understanding protection depth.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`Windows mitigations, ASLR, DEP, NX, CFG, CET, shadow stack, SEHOP, heap guard, ACG, mitigation bypass, exploit mitigation, Windows hardening`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Week 6: Understanding Windows Mitigations
29
30	## Overview
31
32	_created by AnotherOne from @Pwn3rzs Telegram channel_.
33
34	Last week you learned basic exploitation in an environment without protections.
35	This week, you'll learn about the defensive mechanisms that modern Windows systems employ to prevent those attacks.
36	Understanding these mitigations is essential before learning to bypass them (Week 8). Week 7 continues with enterprise security topics (offensive reconnaissance, Windows 11 24H2/25H2 mitigations, cross-platform defenses).
37
38	This Week's Focus:
39
40	- Understand how each mitigation works
41	- Learn to detect active mitigations
42	- Verify mitigation effectiveness
43	- Test exploits against protected binaries
44	- Prepare for Week 7's boundaries and Week 8's bypass techniques
45
46	### Prerequisites
47
48	Before starting this week, ensure you have:
49
50	- Completed Week 5: Basic Exploitation (Linux) - you should be able to exploit stack overflows, build ROP chains, and use pwntools
51	- A Windows 11 VM (isolated, snapshot before each exercise)
52	- Visual Studio 2022 Build Tools installed
53	- WinDbg Preview installed
54	- Basic familiarity with x64 assembly and calling conventions
55
56	### Week 6 Deliverables
57
58	By the end of this week, you should have completed the following:
59
60	- [ ] Lab Environment: Windows 11 VM with Visual Studio Build Tools, WinDbg Preview, and Sysinternals installed
61	- [ ] Test Binaries: Compiled `vulnerable_suite_win_mitigated.c` and `vuln_server_win.c` with various mitigation flags
62	- [ ] DEP Verified: Demonstrated DEP blocking shellcode execution with crash analysis (Exception Code 0xC0000005, Param 8)
63	- [ ] ASLR Measured: Recorded addresses of `check_aslr.exe` across 3 reboots and documented randomization behavior
64	- [ ] Stack Cookie Tested: Triggered `/GS` cookie check failure and analyzed in WinDbg
65	- [ ] CFG Validated: Demonstrated CFG blocking indirect call to invalid target
66	- [ ] Crash Dumps Analyzed: Created at least 3 crash dumps and identified which mitigation caused each termination using `!analyze -v`
67	- [ ] Week 5 Exploit Retesting: Re-ran Week 5 exploits against mitigated binaries and documented failures
68	- [ ] Mitigation Audit Report: Generated system-wide and per-binary mitigation audit using PowerShell scripts
69	- [ ] Hardening Capstone: Completed the SecureServer v1.0 hardening exercise (Day 7)
70
71	### Context
72
73	Why Mitigations Matter: Modern exploits chain multiple vulnerabilities and bypass layers of protection. Understanding mitigations helps you:
74
75	- Recognize when an exploit is blocked vs. when it succeeds
76	- Analyze crash dumps to identify exploitation attempts
77	- Design defense-in-depth strategies
78	- Prepare for Weeks 7-8 (advanced mitigations and bypass techniques)
79
80	Recent CVEs Demonstrating Mitigation Importance:
81
82	\| CVE \| Vulnerability \| Mitigations Involved \| Outcome \|
83	\| -------------- \| ------------------------------- \| -------------------- \| ------------------------------------- \|
84	\| CVE-2024-21338 \| AppLocker (appid.sys) EoP \| KASLR, SMEP, kCFG \| Admin-to-Kernel bypass of kCFG \|
85	\| CVE-2024-30088 \| Authz Kernel TOCTOU \| KASLR, SMEP, CFG \| Exploited via race condition \|
86	\| CVE-2023-36802 \| MSKSSRV Object Type Confusion \| KASLR, SMEP, CFG \| Pool spray + type confusion to EoP \|
87	\| CVE-2025-29824 \| CLFS Driver Use-After-Free \| KASLR, SMEP \| Zero-day exploited in wild (Apr 2025) \|
88	\| CVE-2024-49138 \| CLFS Heap-Based Buffer Overflow \| DEP, ASLR, KASLR \| EoP exploited in wild (Dec 2024) \|
89	\| CVE-2023-32019 \| Windows Kernel Info Disclosure \| KASLR \| Leaked kernel memory bypassing KASLR \|
90	\| CVE-2023-28252 \| CLFS Driver EoP \| KASLR, SMEP \| Abused CLFS log file parsi

People who liked this also viewed

6 picks

Type