Windows Boundaries

This is a reference guide for attacking Windows security boundaries during exploitation work. It covers the taxonomy from AppContainer up through VTL1, with practical examples for crossing kernel/user boundaries via win32k syscalls and IOCTL fuzzing, escaping browser sandboxes through Mojo IPC bugs, and abusing COM elevation for UAC bypasses. The boundary crossing chains are the most useful part, showing complete attack paths like browser renderer to SYSTEM or phishing to kernel via BYOVD. It assumes you already have initial access and need to understand which boundaries you're hitting and what primitives you need to cross them. More useful as a quick reference than a tutorial, but the diagrams and code snippets give you enough context to know what to research deeper.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill windows-boundaries --agent claude-code

Installs into .claude/skills of the current project.

Files

Windows Security Boundaries

When to Activate

Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)
Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers
Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive
Defeating PPL to dump LSASS or tamper with EDR self-defense
Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse
UAC bypass (Medium → High) via auto-elevating COM or registry hijack