privesc-windows
privesc-windows guides you through multiple privilege-escalation paths on Windows hosts, from token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato) and UAC bypass techniques to service/DLL hijacking and kernel exploits. It covers enumeration, exploitation, and credential harvesting with tactical OPSEC guidance and detection evasion for each method.
privesc-windows escalates a low-privilege Windows shell to SYSTEM or admin via token impersonation, UAC bypass, service hijacking, kernel exploits, or credential harvesting.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
privesc-windows escalates a low-privilege Windows shell to SYSTEM or admin via token impersonation, UAC bypass, service hijacking, kernel exploits, or credential harvesting. privesc-windows guides you through multiple privilege-escalation paths on Windows hosts, from token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato) and UAC bypass techniques to service/DLL hijacking and kernel exploits. It covers enumeration, exploitation, and credential harvesting with tactical OPSEC guidance and detection evasion for each method.
Use it when
- privesc-windows details token-impersonation exploitation via the Potato family of tools.
- privesc-windows covers enumeration of Windows privilege escalation vectors using tools like WinPEAS and Seatbelt.
Verify before relying
Read SKILL.md below before installing (12 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/privesc-windows · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is privesc-windows and what does it cover?
privesc-windows is a comprehensive guide to Windows privilege escalation techniques. It covers multiple escalation paths including token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato), UAC bypass methods, service and DLL hijacking, kernel exploits, and credential harvesting from LSASS, SAM, and DPAPI. The guide includes enumeration strategies, exploitation tactics, OPSEC guidance, and detection evasion for each method.
How to escalate privileges on windows using token impersonation?
privesc-windows details token-impersonation exploitation via the Potato family of tools. These techniques exploit the SeImpersonate privilege to escalate from low-privilege shell to SYSTEM/admin. Methods include GodPotato, SigmaPotato, and PrintNotifyPotato, which leverage COM elevation and token impersonation to bypass privilege restrictions. The guide explains the mechanics, prerequisites, and detection evasion for each variant.
What enumeration tools does privesc-windows recommend?
privesc-windows covers enumeration of Windows privilege escalation vectors using tools like WinPEAS and Seatbelt. These tools identify misconfigurations, weak service permissions, unquoted paths, kernel vulnerabilities, and other escalation opportunities. The guide explains how to interpret enumeration output and prioritize exploitation targets based on reliability and OPSEC impact.
Can privesc-windows help with UAC bypass techniques?
Yes. privesc-windows covers UAC bypass methods including fodhelper, icmluautil COM elevation, and other techniques. It also addresses kernel protections and BYOVD (Bring Your Own Vulnerable Driver) approaches for bypassing modern defenses. The guide explains each bypass mechanism, prerequisites, and how to combine them with other escalation vectors.
How does privesc-windows address credential harvesting?
privesc-windows guides credential harvesting from multiple sources: LSASS dumps via Mimikatz, SAM registry extraction for offline cracking, and DPAPI vault extraction. The guide explains each harvesting method, lateral movement implications, and tactical considerations for maintaining access while evading detection.
What service exploitation methods are covered?
privesc-windows covers service-based escalation including DLL hijacking, unquoted service path exploitation, and scheduled task privilege escalation. The guide explains how to identify vulnerable services, craft payloads, and maintain persistence while minimizing detection risk across different Windows versions and configurations.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: privesc-windows description: Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting metadata: type: offensive phase: post-exploitation tools: winpeas, seatbelt, privesccheck, sharpup, godpotato, sigmapotato, printnotifypotato, fullpowers, edrsandblast, mimikatz, nanodump, pypykatz, impacket-secretsdump mitre: TA0004 kill_chain: phase: [exploit, actions] step: [4, 7] attck_tactics: [TA0004, TA0005, TA0006] attck_techniques: [T1134, T1134.001, T1134.002, T1543.003, T1574.001, T1574.009, T1574.010, T1548.002, T1068, T1211, T1003.001, T1003.002, T1555.004, T1053.005, T1547.001] depends_on: [network-attack, exploit-development] feeds_into: [red-team-ops, advanced-redteam, active-directory-attack, edr-evasion] inputs: [shell_access, os_fingerprint, service_account_context] outputs: [elevated_access, system_token, credential_dump, finding_record] references: - references/enumeration-triage.md - references/token-impersonation-potatoes.md -
(truncated - see the full file via the links below)
File tree — 12 files
skills/privesc-windows/SKILL.md
skills/privesc-windows/references/credential-harvesting.md
skills/privesc-windows/references/enumeration-triage.md
skills/privesc-windows/references/kernel-byovd.md
skills/privesc-windows/references/service-dll-hijacking.md
skills/privesc-windows/references/token-impersonation-potatoes.md
skills/privesc-windows/references/uac-bypass.md
skills/privesc-windows/scripts/byovd_loader.c
skills/privesc-windows/scripts/check_potato.py
skills/privesc-windows/scripts/service_hijack_audit.ps1
skills/privesc-windows/scripts/uac_bypass.ps1
skills/privesc-windows/scripts/win_privesc_triage.ps1
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Escalate from low-privilege shell to SYSTEM/admin on Windows host”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Windows Boundaries equips you with techniques and tools to cross Windows security boundaries—from kernel/user mode transitions via win32k/dxgkrnl exploits and BYOVD drivers, to UAC elevation, AppContainer/LPAC sandbox escapes, PPL circumvention, and RPC/ALPC-based token impersonation. Includes enumeration scripts, proof-of-concept exploits, and OPSEC guidance for each attack vector.
This playbook teaches you how to move from low-privilege shell access to SYSTEM or admin on Windows through systematic enumeration and exploitation. It covers token manipulation, Potato family exploits, weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
This skill guides penetration testers through identifying and exploiting Windows kernel vulnerabilities for privilege escalation. It covers automated vulnerability assessment using tools like WES-NG and Watson, then walks through exploitation of named CVEs including PrintNightmare, EternalBlue, and others, with emphasis on reliability and crash risk mitigation.
Windows Token Impersonation helps penetration testers escalate privileges on Windows systems by leveraging dangerous token privileges like SeImpersonate and SeDebug. The skill guides you through obtaining a service account shell, checking for exploitable privileges, and using tools like JuicyPotato, PrintSpoofer, and GodPotato to reach SYSTEM.
Windows Discovery maps privilege escalation vectors on compromised Windows hosts through systematic enumeration of system configuration, user context, services, and misconfigurations. It gathers baseline OS details, token privileges, and group memberships to identify immediate escalation paths, then reports findings to the orchestrator without crossing into exploitation.
Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
More skills threat-hunting (MIT) · Av Edr Evasion (GPL-3.0) · windows-mitigations-bypass (MIT) · Windows Credential Harvesting (GPL-3.0) · exploit-development (MIT) · cloud-security (MIT)