windows-boundaries
Windows Boundaries equips you with techniques and tools to cross Windows security boundaries—from kernel/user mode transitions via win32k/dxgkrnl exploits and BYOVD drivers, to UAC elevation, AppContainer/LPAC sandbox escapes, PPL circumvention, and RPC/ALPC-based token impersonation. Includes enumeration scripts, proof-of-concept exploits, and OPSEC guidance for each attack vector.
Windows Boundaries helps you exploit kernel/user crossings, sandbox escapes, UAC bypasses, and PPL protections to escalate privileges on Windows systems.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/windows-boundaries · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/windows-boundaries ~/.claude/skills/windows-boundariesnpx skillfed install hypnguyen1209/offensive-claude/windows-boundariesFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What Windows kernel privilege escalation techniques does Windows Boundaries cover?
Windows Boundaries provides techniques for exploiting kernel/user mode transitions, including win32k and dxgkrnl vulnerabilities, BYOVD (Bring Your Own Vulnerable Driver) kernel read/write exploits, and direct ring 0 access methods. The skill covers proof-of-concept exploits and enumeration approaches for identifying and leveraging these attack vectors.
How can Windows Boundaries help with UAC bypass and token impersonation?
Windows Boundaries includes UAC bypass methods and RPC/ALPC-based elevation techniques, including SeImpersonate token abuse, COM elevation bypass, and the potato family of exploits. It provides guidance on named pipe impersonation to SYSTEM and token elevation via RPC/ALPC channels.
What sandbox escape techniques are included for AppContainer and LPAC?
Windows Boundaries covers AppContainer and LPAC (Low Privilege AppContainer) escape vectors, including integrity level bypass methods and security boundary enumeration. The skill provides techniques to identify and exploit weaknesses in sandbox restrictions imposed by Chromium, Edge, and other sandboxed environments.
Can Windows Boundaries help bypass PPL and dump LSASS?
Windows Boundaries includes techniques for circumventing Protected Process Light (PPL) restrictions and dumping LSASS with kernel access. It covers kernel-level access methods and provides OPSEC guidance for performing these operations while minimizing detection.
How does Windows Boundaries support security boundary enumeration?
Windows Boundaries provides enumeration scripts and host boundary posture assessment tools to identify escape vectors and security gaps. These scripts help map Windows security boundaries and discover potential privilege escalation paths across kernel/user mode, sandbox, and integrity level transitions.
What OPSEC guidance does Windows Boundaries provide?
Windows Boundaries includes operational security guidance for each attack vector, covering EDR evasion at the kernel level, driver IOCTL fuzzing techniques, and methods to minimize forensic artifacts. The skill emphasizes safe exploitation practices and detection avoidance across all boundary-crossing techniques.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: windows-boundaries description: Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation metadata: type: offensive phase: exploitation tools: WinDbg, OleViewDotNet, NtObjectManager, PrintSpoofer, GodPotato, PPLBlade, UACME, loldrivers, Sysmon mitre: TA0004 kill_chain: phase: [exploit, install] step: [4, 5] attck_tactics: [TA0002, TA0004, TA0005] attck_techniques: [T1068, T1211, T1548.002, T1134.001, T1134.002, T1543.003, T1559, T1112, T1003.001, T1014] depends_on: [privesc-windows, exploit-development] feeds_into: [red-team-ops, edr-evasion] inputs: [sandbox_config, kernel_info, foothold_token] outputs: [boundary_escape, elevated_access, kernel_rw_primitive, system_token] references: - references/kernel-user-boundary.md - references/byovd-kernel-rw.md - references/integrity-uac-com.md - references/sandbox-appcontainer-escape.md - references/ppl-protected-process.md - references/rpc-alpc-boundary.md scripts: -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 14 files
skills/windows-boundaries/SKILL.md
skills/windows-boundaries/references/byovd-kernel-rw.md
skills/windows-boundaries/references/integrity-uac-com.md
skills/windows-boundaries/references/kernel-user-boundary.md
skills/windows-boundaries/references/ppl-protected-process.md
skills/windows-boundaries/references/rpc-alpc-boundary.md
skills/windows-boundaries/references/sandbox-appcontainer-escape.md
skills/windows-boundaries/scripts/byovd_kernel_rw.c
skills/windows-boundaries/scripts/enum_boundaries.ps1
skills/windows-boundaries/scripts/ioctl_fuzzer.py
skills/windows-boundaries/scripts/named_pipe_impersonate.c
skills/windows-boundaries/scripts/ppl_byovdll.c
skills/windows-boundaries/scripts/sandbox_escape_probe.py
skills/windows-boundaries/scripts/uac_com_elevate.cpp