windows-privilege-escalationlisted

Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.
snowflakeovo/privilege-escalation-skills · ★ 1 · Testing & QA · score 69

Install: claude install-skill snowflakeovo/privilege-escalation-skills

# SKILL: Windows Local Privilege Escalation — Expert Attack Playbook > **Scope**: Expert Windows privesc techniques. Covers token manipulation, Potato family, service misconfigurations, DLL hijacking, AlwaysInstallElevated, scheduled task abuse, registry autoruns, and named pipe impersonation. Pays particular attention to privilege prerequisites and OS-version-specific constraints. ## Related Skills Before going deep, see also: - `windows-lateral-movement` after escalation for pivoting to other hosts - `windows-av-evasion` when AV/EDR blocks your privesc tools - `active-directory-kerberos-attacks` when the host is domain-joined and you need AD-level escalation - `active-directory-acl-abuse` for domain privilege escalation via ACL misconfigurations ### Advanced Reference Also load [TOKEN_POTATO_TRICKS.md](./TOKEN_POTATO_TRICKS.md) when you need: - Detailed Potato family comparison (JuicyPotato → GodPotato evolution) - OS-version-specific exploit selection - Required privileges and protocol details per variant Also load [UAC_BYPASS_METHODS.md](./UAC_BYPASS_METHODS.md) when you need: - UAC bypass technique matrix (fodhelper, eventvwr, sdclt, etc.) - Auto-elevate binary abuse - Mock trusted directory tricks --- ## 1. ENUMERATION CHECKLIST ### System Context ```cmd whoami /all & REM Current user, groups, privileges systeminfo & REM OS version, hotfixes, architecture hostname & REM Machine name net