windows-boundaries

Featured

Use when crossing a Windows security boundary or escaping a sandbox — kernel/user crossing (win32k/dxgkrnl UAF CVE-2025-24983), BYOVD kernel R/W, UAC/COM elevation, AppContainer/LPAC & Chromium-Mojo sandbox escape (CVE-2025-2783), PPL bypass, RPC/ALPC & named-pipe impersonation

AI & Automation 382 stars 66 forks Updated 5 days ago MIT

Install

View on GitHub

Quality Score: 95/100

Stars 20%
86
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Windows Security Boundaries ## When to Activate - Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line) - Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers - Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive - Defeating PPL to dump LSASS or tamper with EDR self-defense - Going from a `SeImpersonate` service account to SYSTEM via RPC/ALPC/named-pipe abuse - UAC bypass (Medium → High) via auto-elevating COM or registry hijack ## Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM. ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | win32k / dxgkrnl UAF → kernel R/W → token steal | T1068 | CWE-416 | references/kernel-user-boundary.md | scripts/ioctl_fuzzer.py | | Driver IOCTL abuse (METHOD_NEITHER arb-R/W) | T1068 | CWE-781 | references/kernel-user-boundary.md | scripts/ioctl_fuzzer.py | | BYOVD load + MSR/LSTAR or phys R/W → SYSTEM | T1068, T1543.003 | CWE-1188 | references/byovd-kernel-rw.md | scripts/byovd_kernel_rw.c | | BYOVD EDR-kill (callback nulling) | T1562.001, T1014 | CWE-1188 | references/byovd-kernel-rw.md | scripts/byovd_kernel_rw.c |...

Details

Author
hypnguyen1209
Repository
hypnguyen1209/offensive-claude
Created
4 months ago
Last Updated
5 days ago
Language
Python
License
MIT

Bundled in these plugins

offensive-claude

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Featured

windows-mitigations-bypass

Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI

382 Updated 5 days ago
hypnguyen1209
AI & Automation Featured

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

382 Updated 5 days ago
hypnguyen1209
Data & Documents Featured

offensive-windows-privesc

Comprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\SYSTEM: token impersonation via SeImpersonate and SeAssignPrimaryToken privileges using JuicyPotato, PrintSpoofer, GodPotato, SweetPotato, and RoguePotato; service misconfigurations including unquoted service paths, weak service DACLs, writable service binaries, and insecure service creation permissions; AlwaysInstallElevated MSI exploitation; DLL hijacking through search order abuse, phantom DLL loading, and writable PATH directory injection; UAC bypass techniques via fodhelper.exe, eventvwr.exe, CMSTP, and environment variable manipulation; scheduled task abuse for writable task actions and new task creation; registry autorun exploitation for persistence and escalation; PrintNightmare (CVE-2021-34527) for remote and local privilege escalation; and credential harvesting from SAM database extraction, DPAPI blob decryption, LSA secret dumping, and

6,950 Updated 6 days ago
SnailSploit