windows-privilege-escalation
This playbook teaches you how to move from low-privilege shell access to SYSTEM or admin on Windows through systematic enumeration and exploitation. It covers token manipulation, Potato family exploits, weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
Windows Privilege Escalation guides you through token abuse, service misconfigurations, and DLL hijacking to reach SYSTEM from low-privilege shell access.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Windows Privilege Escalation guides you through token abuse, service misconfigurations, and DLL hijacking to reach SYSTEM from low-privilege shell access. This playbook teaches you how to move from low-privilege shell access to SYSTEM or admin on Windows through systematic enumeration and exploitation. It covers token manipulation, Potato family exploits, weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
Use it when
- windows-privilege-escalation identifies and exploits service misconfigurations for privilege gain.
- windows-privilege-escalation leverages token manipulation through Potato family exploits including JuicyPotato, GodPotato, and PrintSpoofer.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/windows-privilege-escalation · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What windows privilege escalation techniques does this playbook cover?
windows-privilege-escalation teaches systematic methods to move from low-privilege shell to SYSTEM or admin. It covers token manipulation, Potato family exploits (JuicyPotato, GodPotato, PrintSpoofer), weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
How do I escalate privileges on windows using service misconfigurations?
windows-privilege-escalation identifies and exploits service misconfigurations for privilege gain. The playbook covers unquoted service paths, weak file permissions, and service binary hijacking. It includes enumeration techniques to find vulnerable services and step-by-step exploitation methods tailored to different Windows versions.
What are Potato exploits and how does windows-privilege-escalation use them?
windows-privilege-escalation leverages token manipulation through Potato family exploits including JuicyPotato, GodPotato, and PrintSpoofer. These techniques abuse token impersonation and named pipe interactions to escalate from service accounts to SYSTEM, with specific guidance on which variant works best for your target OS version.
Can windows-privilege-escalation help me bypass UAC?
Yes. windows-privilege-escalation covers UAC bypass techniques to achieve elevated code execution. The playbook details multiple bypass methods including registry manipulation, scheduled task abuse, and application whitelisting bypasses, with commands and tool recommendations for each approach.
How does windows-privilege-escalation enumerate Windows security posture?
windows-privilege-escalation provides systematic enumeration methods to identify escalation paths. It includes guidance on using tools like WinPEAS and PowerUp to discover weak configurations, misconfigurations, and exploitable conditions across services, registry, scheduled tasks, and file permissions.
What about DLL hijacking and token impersonation in windows-privilege-escalation?
windows-privilege-escalation covers DLL hijacking for privilege escalation by exploiting search path vulnerabilities and weak DLL loading. It also details token impersonation techniques including SeImpersonate privilege exploitation, named pipe impersonation, and credential dumping from LSASS for comprehensive privilege escalation paths.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Windows Local Privilege Escalation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert Windows privesc techniques. Covers token manipulation, Potato family, service misconfigurations, DLL hijacking, AlwaysInstallElevated, scheduled task abuse, registry autoruns, and named pipe impersonation. Base models miss nuanced privilege prerequisites and OS-version-specific constraints.
0. RELATED ROUTING
Before going deep, consider loading:
- windows-lateral-movement after escalation for pivoting to other hosts
- windows-av-evasion when AV/EDR blocks your privesc tools
- active-directory-kerberos-attacks when the host is domain-joined and you need AD-level escalation
- active-directory-acl-abuse for domain privilege
(truncated - see the full file via the links below)
File tree — 3 files
skills/windows-privilege-escalation/SKILL.md
skills/windows-privilege-escalation/TOKEN_POTATO_TRICKS.md
skills/windows-privilege-escalation/UAC_BYPASS_METHODS.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Escalate from low-privilege to SYSTEM/admin on Windows”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Windows Token Impersonation helps penetration testers escalate privileges on Windows systems by leveraging dangerous token privileges like SeImpersonate and SeDebug. The skill guides you through obtaining a service account shell, checking for exploitable privileges, and using tools like JuicyPotato, PrintSpoofer, and GodPotato to reach SYSTEM.
privesc-windows guides you through multiple privilege-escalation paths on Windows hosts, from token-impersonation attacks (GodPotato, SigmaPotato, PrintNotifyPotato) and UAC bypass techniques to service/DLL hijacking and kernel exploits. It covers enumeration, exploitation, and credential harvesting with tactical OPSEC guidance and detection evasion for each method.
Windows Discovery maps privilege escalation vectors on compromised Windows hosts through systematic enumeration of system configuration, user context, services, and misconfigurations. It gathers baseline OS details, token privileges, and group memberships to identify immediate escalation paths, then reports findings to the orchestrator without crossing into exploitation.
This skill guides penetration testers through identifying and exploiting Windows kernel vulnerabilities for privilege escalation. It covers automated vulnerability assessment using tools like WES-NG and Watson, then walks through exploitation of named CVEs including PrintNightmare, EternalBlue, and others, with emphasis on reliability and crash risk mitigation.
Locate and extract credentials cached on Windows systems through registry queries, file searches, shadow copies, and DPAPI decryption. Covers browser passwords, saved sessions, unattend files, and vault entries accessible without domain access.
Exploitation guides you through the full attack chain: finding public exploits via Exploit-DB, executing Metasploit modules against identified vulnerabilities, and crafting standalone payloads with msfvenom. Use it to move from vulnerability discovery to shell establishment during authorized security assessments.
More skills windows-boundaries (MIT) · linux-privilege-escalation (MIT)