Windows Privilege Escalation

This is a comprehensive privesc playbook that walks you through the standard Windows escalation ladder: token abuse via the Potato family (JuicyPotato through GodPotato), service misconfigurations like unquoted paths and weak ACLs, DLL hijacking, AlwaysInstallElevated, and registry autoruns. The enumeration checklist maps privilege flags (SeImpersonatePrivilege, SeDebugPrivilege) to specific exploits, and the tool selection tables break down OS version constraints, which base models consistently mess up. It references two supplemental docs for deeper Potato exploit selection and UAC bypass techniques. Load this when you have a low privilege shell and need to get SYSTEM or admin, whether through service account token impersonation or classic misconfig exploitation.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill windows-privilege-escalation --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Windows Local Privilege Escalation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Windows privesc techniques. Covers token manipulation, Potato family, service misconfigurations, DLL hijacking, AlwaysInstallElevated, scheduled task abuse, registry autoruns, and named pipe impersonation. Base models miss nuanced privilege prerequisites and OS-version-specific constraints.

0. RELATED ROUTING

Before going deep, consider loading:

windows-lateral-movement after escalation for pivoting to other hosts
windows-av-evasion when AV/EDR blocks your privesc tools
active-directory-kerberos-attacks when the host is domain-joined and you need AD-level escalation
active-directory-acl-abuse for domain privilege escalation via ACL misconfigurations