Offensive Windows Privesc
Comprehensive Windows privilege escalation methodology for offensive security engagements.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-windows-privesc -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Design
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\\SYSTEM: token impersonation via SeImpersonate and SeAssignPrimaryToken privileges using JuicyPotato, PrintSpoofer, GodPotato, SweetPotato, and RoguePotato; service misconfigurations including unquoted service paths, weak service DACLs, writable service binaries, and insecure service creation permissions; AlwaysInstallElevated MSI exploitation; DLL hijacking through search order abuse, phantom DLL loading, and writable PATH directory injection; UAC bypass techniques via fodhelper.exe, eventvwr.exe, CMSTP, and environment variable manipulation; scheduled task abuse for writable task actions and new task creation; registry autorun exploitation for persistence and escalation; PrintNightmare (CVE-2021-34527) for remote and local privilege escalation; and credential harvesting from SAM database extraction, DPAPI blob decryption, LSA secret dumping, and Credential Manager enumeration. Integrates automated enumeration with WinPEAS, PowerUp, SharpUp, Seatbelt, and BeRoot. Each technique includes detection signatures and defender-side visibility for purple team operations. Maps to MITRE ATT&CK T1548 (Abuse Elevation Control Mechanism) and T1574 (Hijack Execution Flow). Designed for authorized penetration testing, red team engagements, and CTF competitions where you hold a standard user shell and need to escalate to SYSTEM
Windows Privilege Escalation
You have a standard user shell on a Windows target. Your objective is to escalate to NT AUTHORITY\SYSTEM or local Administrator through systematic enumeration and exploitation of misconfigurations, vulnerable services, and unpatched software. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques.
Windows privilege escalation differs fundamentally from Linux. The attack surface centers on services, tokens, the registry, DLL loading mechanics, and the Windows access control model. Master these primitives and you can chain findings from any enumeration tool into a working escalation path.
Quick Workflow
- Run automated enumeration (WinPEAS, PowerUp, Seatbelt) to surface misconfigurations.
- Check current privileges -- SeImpersonate/SeAssignPrimaryToken are immediate wins.
- Enumerate services for unquoted paths, weak DACLs, and writable binaries.
- Check AlwaysInstallElevated registry keys for MSI-based escalation.
- Identify DLL hijacking opportunities in privileged processes.
- Attempt UAC bypass if running as a local admin without elevated context.
- Inspect scheduled tasks, registry autoruns, and writable PATH directories.
- Harvest credentials from SAM, DPAPI, LSA secrets, and Credential Manager.
- Check for PrintNightmare and other unpatched vulnerabilities as a last resort.
Automated Enumeration
Run automated tools first to build a comprehensive picture of the attack surface. Review output methodically -- these tools surface findings you would otherwise miss.
# WinPEAS
.\winPEASx64.exe > C:\Users\Public\winpeas.txt 2>&1
.\winPEASx64.exe servicesinfo # Specific checks only
# PowerUp
Import-Module .\PowerUp.ps1
Invoke-AllChecks | Out-File -FilePath C:\Users\Public\powerup.txt
# SharpUp / Seatbelt / BeRoot
.\SharpUp.exe audit
.\Seatbelt.exe -group=all > C:\Users\Public\seatbelt.txt
.\beRoot.exe
