privesc-windows

MALICIOUS. The skill’s stated purpose is offensive Windows post-exploitation: escalate privileges, bypass security controls, dump credentials, and aid lateral movement. Its capabilities are fully aligned with that malicious purpose, and the external tooling footprint increases risk further, but the core issue is that this skill equips an AI agent to execute real attack techniques against a host.

No embedded executable malware is demonstrated in the supplied text, but it is a highly actionable offensive guide for kernel privilege escalation, BYOVD exploitation, credential extraction, EDR impairment, and token abuse. Treat the material as dangerous operational content; independently validate all CVE and driver assertions, and do not execute the commands or referenced loader outside an authorized, isolated test environment.

This fragment is a dual-use Windows privilege-escalation enumeration toolkit, but its direct credential harvesting and explicit OPSEC/evasion instructions strongly indicate offensive or unauthorized use. It contains no shown payload for network exfiltration or persistence, yet it creates substantial risk by exposing secrets and guiding escalation while minimizing detection. Review and isolate the unseen triage script before execution.

The fragment contains clear Windows privilege-escalation and post-exploitation behavior. It steals or impersonates a privileged token and launches a SYSTEM command shell, while the accompanying text provides evasion, artifact-cleanup, and operational guidance. This is highly dangerous code and should not be included in a normal package or executed outside a controlled, explicitly authorized security-testing environment.

The supplied fragment is an offensive Windows privilege-escalation and persistence guide containing executable commands and a DLL payload. It can facilitate SYSTEM-level code execution, local administrator modification, and scheduled-task persistence when used against vulnerable hosts. It does not itself appear to be package malware or an automatically executing supply-chain implant, but the included payload and operational instructions are high-risk if executed outside an authorized testing environment.

This material is an offensive UAC-bypass playbook, not benign application code. It provides working commands to hijack per-user registry handlers, invoke auto-elevated binaries or COM objects, execute arbitrary payloads with elevated integrity, potentially obtain SYSTEM through AlwaysInstallElevated, and evade detection. It does not itself demonstrate network exfiltration or a packaged malware implant, but use of the commands can directly enable unauthorized privilege escalation and persistence. Treat as high-risk content and do not execute outside an authorized, isolated test environment.

This is a privileged BYOVD exploitation harness, not a benign general-purpose driver installer. It is explicitly designed to load vulnerable kernel drivers and send arbitrary IOCTLs capable of kernel read/write or security-bypass operations. The visible code does not contain an embedded malware payload, credential theft, or network exfiltration, but its intended functionality is highly dangerous and can facilitate system compromise. The assessment is limited because the supplied fragment is incomplete.

The fragment contains no direct malicious payload or automatic exploitation: it only reads arguments/a specified file, analyzes text, and prints recommendations. However, its explicit purpose is to guide Windows privilege escalation to SYSTEM and it prints commands involving known escalation tools and cmd. It should be treated as dual-use offensive security tooling and restricted to authorized testing. The main security concern is misuse and inaccurate recommendations, not supply-chain malware behavior.

The audit portions are legitimate defensive enumeration and are primarily read-only. However, the -GenDll feature is an explicit offensive payload generator: it creates a proxy-DLL stub whose DllMain executes a hidden command to add a user to the local Administrators group when loaded in a privileged process. This is a significant security concern and makes the overall file dual-use with a directly implemented privilege-escalation capability.

This is an explicit credential-harvesting and defense-evasion playbook. It provides working procedures for extracting LSASS secrets, SAM and LSA data, cached credentials, browser passwords, and DPAPI-protected material, including methods intended to bypass EDR and PPL protections. It should be treated as highly dangerous content and not included in a legitimate software supply-chain package.

The fragment is a warning-only branch that provides explicit guidance for registry symlink evasion in conjunction with known UAC bypass methods. It is highly suspicious from a defensive perspective and could support stealthy privilege-elevation tooling, but it does not itself execute the bypass or contain malware behavior. Review the surrounding code for registry API calls, process launches, payload handling, and privilege-elevation logic.