Windows Privilege Escalation Methodology
Guides an agent through escalating a Windows shell to SYSTEM or local admin for authorized pentests
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This skill gives an AI agent a structured playbook for taking a low-privilege Windows account and raising it to SYSTEM or local Administrator, the kind of step a security tester performs during an authorized penetration test or CTF. It covers token impersonation (Potato-family tools), misconfigured services, DLL hijacking, UAC bypasses, scheduled tasks, credential harvesting, and known unpatched vulnerabilities, and it tells the agent which enumeration tools to run first. The SKILL.md itself only contains instructions and command examples; it describes how to attack and how to detect these techniques for purple-team work.
Great for
- Penetration testers and red teamers working on an authorized Windows engagement
- Students or CTF players practicing Windows privilege escalation in a lab
- Blue teams wanting to understand the attack paths they should detect and monitor
Skip it if
- Attacking systems you do not own or have written permission to test, since the techniques are illegal to use without authorization
- Production hardening or general IT administration, because the content is written from an attacker's perspective and does not provide remediation steps
- Beginners expecting a guided tutorial, since it assumes working knowledge of Windows internals, tooling and command-line usage
Try asking
- “I have a low-privilege shell on a Windows 10 lab box. Walk me through escalating to SYSTEM using the methodology.”
- “Enumerate this Windows target for service misconfigurations and unquoted service paths.”
- “Check whether this account has SeImpersonatePrivilege and suggest which potato tool fits the OS version.”
- “Help me map the privilege escalation techniques I tested to MITRE ATT&CK T1548 and T1574 with detection notes for the report.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-windows-privesc.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-windows-privesc.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-windows-privesc.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Confirm written scope and authorization before any command is run; the skill itself does not check this.
- Review each tool binary and script yourself before the agent executes it, since the referenced exploit binaries are untrusted third-party code.
- Use the detection and defender-side sections to produce purple-team findings and remediation recommendations for the client report.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.