The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides comprehensive instructions for escalating privileges on Windows systems through various vectors.
Includes multiple techniques for User Account Control (UAC) bypass using binaries like fodhelper.exe, eventvwr.exe, and WSReset.exe.
Details the abuse of token privileges such as SeImpersonatePrivilege, SeDebugPrivilege, and SeBackupPrivilege using the 'Potato' family of exploits.
Provides methods for exploiting service misconfigurations (unquoted paths, weak permissions) and scheduled task abuse.
[CREDENTIALS_UNSAFE]: Instructions are included to directly access and extract sensitive authentication data.
Commands for dumping the memory of the Local Security Authority Subsystem Service (LSASS) via procdump -ma lsass.exe.
Methods for extracting sensitive registry hives (SAM, SYSTEM, SECURITY) using reg save to retrieve local account secrets.
Enumeration of stored credentials via cmdkey /list and direct access to AppData credential storage paths.
[PERSISTENCE]: The skill outlines techniques to maintain access across sessions.
Explicit command to create a new user and add them to the local administrators group: net user hacker P@ss123 /add && net localgroup administrators hacker /add.
Instructions for hijacking registry autorun keys (HKLM\...\Run) to ensure malicious code executes upon system startup.
Guidance on creating malicious scheduled tasks to run as the SYSTEM user.
[COMMAND_EXECUTION]: Extensive use of shell commands and system utilities to alter system state.
Reconfiguring services using sc config to point to malicious binaries.
Modifying file and directory permissions using icacls and takeown.
Manipulating the Windows registry to change execution policies and environment variables.
[DYNAMIC_EXECUTION]: Employs techniques to load or execute code dynamically at runtime.
Detailed instructions for DLL hijacking by placing malicious files in high-priority search directories or using 'Mock Trusted Directory' tricks.
Spawning system-level shells by migrating to existing processes or using token impersonation tools.
Instructions for generating and executing malicious MSI packages via msiexec.
[REMOTE_CODE_EXECUTION]: Provides patterns for executing code from remote sources.
The CMSTP UAC bypass method includes a pattern to execute a remote Scriptlet (.sct) payload via a URL.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where untrusted system data is processed to determine next steps.
Ingestion points: Ingests output from system enumeration commands (systeminfo, whoami /all, wmic, sc query, schtasks) across all files.
Boundary markers: None identified; system output is processed directly to guide exploitation.
Capability inventory: Significant capabilities including administrative command execution, registry modification, file system manipulation, and network operations (PrintSpoofer64.exe, GodPotato.exe, Akagi64.exe).
Sanitization: No evidence of sanitization or validation of the system output before the agent acts upon it.

windows-privilege-escalation