Privesc Windows

You've got a shell on a Windows box and need SYSTEM or domain admin. This walks through the full escalation playbook: token impersonation with the Potato family exploits, service misconfigurations, UAC bypasses via fodhelper and eventvwr, and credential dumping with Mimikatz. The token manipulation section is especially thorough, covering SeImpersonatePrivilege abuse and named pipe tricks. For AD environments, it includes Kerberoasting, AS-REP roasting, delegation attacks, and ADCS exploitation. The automated enumeration commands with WinPEAS and Seatbelt are good starting points. This is comprehensive enough that you'll likely reference specific sections rather than read it sequentially. Works best when you already understand Windows security primitives and just need the syntax and tool chains.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill privesc-windows --agent claude-code

Installs into .claude/skills of the current project.

Files

Windows Privilege Escalation

When to Activate

Gained an initial shell / foothold on Windows and need to reach Administrator or NT AUTHORITY\SYSTEM
Shell runs as a service account (IIS APPPOOL, MSSQL, Local/Network Service) holding SeImpersonatePrivilege
Standard-user → admin via UAC bypass (medium → high integrity) on a local-admin-group member
Service / DLL / scheduled-task misconfiguration hunting on the host
Kernel EoP via an unpatched local CVE or Bring-Your-Own-Vulnerable-Driver (admin → kernel/PPL)
Privileged token-right abuse (SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug)
Local credential harvesting (LSASS, SAM/SYSTEM, DPAPI) to fuel lateral movement