The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides exhaustive methodologies for elevating privileges to SYSTEM or Administrator on Windows systems.
Example 1 and 4 demonstrate service binary path exploitation and unquoted service paths to gain elevated code execution.
Example 3 and the detailed guide provide instructions for using the "Potato" family of exploits (JuicyPotato, PrintSpoofer, RoguePotato, GodPotato) for token impersonation.
Section 5 of the guide details kernel exploitation discovery using tools like Windows Exploit Suggester (WES), Watson, and Sherlock.
[DATA_EXFILTRATION]: Provides comprehensive instructions for harvesting sensitive system credentials and secrets.
The guide includes commands for extracting the SAM and SYSTEM hives to dump password hashes.
It provides recursive search patterns to find plaintext passwords in files (Unattend.xml, web.config) and the Windows registry.
Specific commands are included to extract cleartext Wi-Fi passwords and PowerShell command history which may contain sensitive credentials.
[CREDENTIALS_UNSAFE]: The skill contains hardcoded credentials within its example command blocks.
Example 5 includes a command sequence using the password "P@ssw0rd123" for the Administrator account with runas and psexec.
[COMMAND_EXECUTION]: Instructs the agent/user to execute a wide array of powerful system tools and third-party offensive binaries.
Commands involve sc, reg, wmic, icacls, and various external penetration testing tools like accesschk.exe and mimikatz.
[PERSISTENCE]: Includes techniques that can be repurposed for persistent access.
Modifying service binary paths (sc config MyService binpath=...) allows a malicious executable to run automatically as a system service.
[DYNAMIC_EXECUTION]: Describes methods for executing code via system configuration changes and script injection.
Section 6 of the guide provides a methodology for DLL Hijacking, involving the compilation and placement of malicious DLLs in application search paths.
Detailed instructions for executing PowerShell scripts while bypassing system execution policies (-ExecutionPolicy Bypass).

windows-privilege-escalation