windows-privilege-escalation
This playbook teaches you how to move from low-privilege shell access to SYSTEM or admin on Windows through systematic enumeration and exploitation. It covers token manipulation, Potato family exploits, weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
Windows Privilege Escalation guides you through token abuse, service misconfigurations, and DLL hijacking to reach SYSTEM from low-privilege shell access.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/windows-privilege-escalation · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/windows-privilege-escalation ~/.claude/skills/windows-privilege-escalationnpx skillfed install yaklang/hack-skills/windows-privilege-escalationFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What windows privilege escalation techniques does this playbook cover?
windows-privilege-escalation teaches systematic methods to move from low-privilege shell to SYSTEM or admin. It covers token manipulation, Potato family exploits (JuicyPotato, GodPotato, PrintSpoofer), weak service configurations, DLL hijacking, UAC bypass techniques, scheduled task abuse, and registry autorun abuse—each with specific commands and tool recommendations for different OS versions.
How do I escalate privileges on windows using service misconfigurations?
windows-privilege-escalation identifies and exploits service misconfigurations for privilege gain. The playbook covers unquoted service paths, weak file permissions, and service binary hijacking. It includes enumeration techniques to find vulnerable services and step-by-step exploitation methods tailored to different Windows versions.
What are Potato exploits and how does windows-privilege-escalation use them?
windows-privilege-escalation leverages token manipulation through Potato family exploits including JuicyPotato, GodPotato, and PrintSpoofer. These techniques abuse token impersonation and named pipe interactions to escalate from service accounts to SYSTEM, with specific guidance on which variant works best for your target OS version.
Can windows-privilege-escalation help me bypass UAC?
Yes. windows-privilege-escalation covers UAC bypass techniques to achieve elevated code execution. The playbook details multiple bypass methods including registry manipulation, scheduled task abuse, and application whitelisting bypasses, with commands and tool recommendations for each approach.
How does windows-privilege-escalation enumerate Windows security posture?
windows-privilege-escalation provides systematic enumeration methods to identify escalation paths. It includes guidance on using tools like WinPEAS and PowerUp to discover weak configurations, misconfigurations, and exploitable conditions across services, registry, scheduled tasks, and file permissions.
What about DLL hijacking and token impersonation in windows-privilege-escalation?
windows-privilege-escalation covers DLL hijacking for privilege escalation by exploiting search path vulnerabilities and weak DLL loading. It also details token impersonation techniques including SeImpersonate privilege exploitation, named pipe impersonation, and credential dumping from LSASS for comprehensive privilege escalation paths.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Windows Local Privilege Escalation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert Windows privesc techniques. Covers token manipulation, Potato family, service misconfigurations, DLL hijacking, AlwaysInstallElevated, scheduled task abuse, registry autoruns, and named pipe impersonation. Base models miss nuanced privilege prerequisites and OS-version-specific constraints.
0. RELATED ROUTING
Before going deep, consider loading:
- windows-lateral-movement after escalation for pivoting to other hosts
- windows-av-evasion when AV/EDR blocks your privesc tools
- active-directory-kerberos-attacks when the host is domain-joined and you need AD-level escalation
- active-directory-acl-abuse for domain privilege
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
skills/windows-privilege-escalation/SKILL.md
skills/windows-privilege-escalation/TOKEN_POTATO_TRICKS.md
skills/windows-privilege-escalation/UAC_BYPASS_METHODS.md