privesc-windows
privesc-windows guides you through multiple privilege-escalation paths on Windows hosts, from token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato) and UAC bypass techniques to service/DLL hijacking and kernel exploits. It covers enumeration, exploitation, and credential harvesting with tactical OPSEC guidance and detection evasion for each method.
privesc-windows escalates a low-privilege Windows shell to SYSTEM or admin via token impersonation, UAC bypass, service hijacking, kernel exploits, or credential harvesting.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/privesc-windows · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/privesc-windows ~/.claude/skills/privesc-windowsnpx skillfed install hypnguyen1209/offensive-claude/privesc-windowsFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is privesc-windows and what does it cover?
privesc-windows is a comprehensive guide to Windows privilege escalation techniques. It covers multiple escalation paths including token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato), UAC bypass methods, service and DLL hijacking, kernel exploits, and credential harvesting from LSASS, SAM, and DPAPI. The guide includes enumeration strategies, exploitation tactics, OPSEC guidance, and detection evasion for each method.
How to escalate privileges on windows using token impersonation?
privesc-windows details token-impersonation exploitation via the Potato family of tools. These techniques exploit the SeImpersonate privilege to escalate from low-privilege shell to SYSTEM/admin. Methods include GodPotato, SigmaPotato, and PrintNotifyPotato, which leverage COM elevation and token impersonation to bypass privilege restrictions. The guide explains the mechanics, prerequisites, and detection evasion for each variant.
What enumeration tools does privesc-windows recommend?
privesc-windows covers enumeration of Windows privilege escalation vectors using tools like WinPEAS and Seatbelt. These tools identify misconfigurations, weak service permissions, unquoted paths, kernel vulnerabilities, and other escalation opportunities. The guide explains how to interpret enumeration output and prioritize exploitation targets based on reliability and OPSEC impact.
Can privesc-windows help with UAC bypass techniques?
Yes. privesc-windows covers UAC bypass methods including fodhelper, icmluautil COM elevation, and other techniques. It also addresses kernel protections and BYOVD (Bring Your Own Vulnerable Driver) approaches for bypassing modern defenses. The guide explains each bypass mechanism, prerequisites, and how to combine them with other escalation vectors.
How does privesc-windows address credential harvesting?
privesc-windows guides credential harvesting from multiple sources: LSASS dumps via Mimikatz, SAM registry extraction for offline cracking, and DPAPI vault extraction. The guide explains each harvesting method, lateral movement implications, and tactical considerations for maintaining access while evading detection.
What service exploitation methods are covered?
privesc-windows covers service-based escalation including DLL hijacking, unquoted service path exploitation, and scheduled task privilege escalation. The guide explains how to identify vulnerable services, craft payloads, and maintain persistence while minimizing detection risk across different Windows versions and configurations.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: privesc-windows description: Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting metadata: type: offensive phase: post-exploitation tools: winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump mitre: TA0004 kill_chain: phase: [exploit, actions] step: [4, 7] attck_tactics: [TA0004, TA0005, TA0006] attck_techniques: [T1134, T1134.001, T1134.002, T1543.003, T1574.001, T1574.009, T1574.010, T1548.002, T1068, T1211, T1003.001, T1003.002, T1555.004, T1053.005, T1547.001] depends_on: [network-attack, exploit-development] feeds_into: [red-team-ops, advanced-redteam, active-directory-attack, edr-evasion] inputs: [shell_access, os_fingerprint, service_account_context] outputs: [elevated_access, system_token, credential_dump, finding_record] references: - references/enumeration-triage.md - references/token-impersonation-potatoes.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 12 files
skills/privesc-windows/SKILL.md
skills/privesc-windows/references/credential-harvesting.md
skills/privesc-windows/references/enumeration-triage.md
skills/privesc-windows/references/kernel-byovd.md
skills/privesc-windows/references/service-dll-hijacking.md
skills/privesc-windows/references/token-impersonation-potatoes.md
skills/privesc-windows/references/uac-bypass.md
skills/privesc-windows/scripts/byovd_loader.c
skills/privesc-windows/scripts/check_potato.py
skills/privesc-windows/scripts/service_hijack_audit.ps1
skills/privesc-windows/scripts/uac_bypass.ps1
skills/privesc-windows/scripts/win_privesc_triage.ps1