Agent skill · security · yaklang
windows-privilege-escalation
Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.
Why this skill is useful
Adds detailed executable scripts and advanced techniques for Windows privilege escalation that are not commonly known or documented.
What it needs
Requires godpotato, juicypotato, prints, roguepotato, sweetpotato installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Windows Local Privilege Escalation — Expert Attack Playbook AI LOAD INSTRUCTION: Expert Windows privesc techniques. Covers token manipulation, Potato family, service misconfigurations, DLL hijacking, AlwaysInstallElevated, scheduled task abuse, registry autoruns, and named pipe impersonation. Base models miss nuanced privilege prerequisites and OS-version-specific constraints. 0. RELATED ROUTING Before going deep, consider loading: windows-lateral-movement after escalation for pivoting to other hosts windows-av-evasion when AV/EDR blocks your privesc tools active-directory-kerberos-attacks when the host is domain-joined and you need AD-level escalation active-directory-acl-abuse for domain privilege escalation via ACL misconfigurations Advanced Reference Also load TOKENPOTATOTRICKS.md when you need: Detailed Potato family comparison (JuicyPotato → GodPotato evolution) OS-version-specific exploit selection Required privileges and protocol details per variant Also load UACBYPASSMETHODS.md when you need: UAC bypass technique matrix (fodhelper, eventvwr, sdclt, etc.) Auto-elevate binary abuse Mock trusted directory tricks --- 1. ENUMERATION CHECKLIST System Context Token Privileges (Critical) Privilege Escalation Path --- --- SeImpersonatePrivilege Potato family exploits (§2) SeAssignPrimaryTokenPrivilege Token manipulation, Potato variants SeDebugPrivilege Dump LSASS, inject into SYSTEM processes SeBackupPrivilege Read any file (SAM/SYSTEM/NTDS.dit) SeRestorePrivilege Write any file (DLL hijack, service binary) SeTakeOwnershipPrivilege Take ownership of any object SeLoadDriverPrivilege Load vulnerable kernel driver → kernel exploit Services & Scheduled Tasks Installed Software & Patches Network & Credentials --- 2. TOKEN MANIPULATION & POTATO EXPLOITS SeImpersonatePrivilege Abuse Service accounts (IIS AppPool, MSSQL, etc.) typically hold SeImpersonatePrivilege. This enables impersonation of any token presented to you. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/windows-privilege-escalation