The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides explicit instructions and commands for escalating privileges from a standard user to NT AUTHORITY\SYSTEM. This includes:
Abusing token impersonation via the 'Potato' family of exploits (JuicyPotato, PrintSpoofer, GodPotato, RoguePotato).
Exploiting service misconfigurations such as unquoted service paths and weak DACLs using 'sc.exe'.
Bypassing User Account Control (UAC) via 'fodhelper.exe', 'eventvwr.exe', and 'CMSTP'.
Exploiting AlwaysInstallElevated registry settings and PrintNightmare (CVE-2021-34527).
[DATA_EXFILTRATION]: The skill documents methods for extracting sensitive system files for offline analysis and credential theft. This includes:
Saving HKLM\SAM, HKLM\SYSTEM, and HKLM\SECURITY registry hives using 'reg save'.
Using Volume Shadow Copy (VSS) to bypass file locks and copy sensitive SAM/SYSTEM files.
Establishing reverse shells using Netcat ('nc.exe') to send command execution results to an external 'attacker_ip'.
[CREDENTIALS_UNSAFE]: Comprehensive instructions for harvesting credentials from various Windows components are provided:
Extraction of LSA secrets and SAM database hashes using Mimikatz.
Decryption of DPAPI blobs and enumeration of stored credentials via 'cmdkey /list'.
Searching for cleartext passwords in unattended installation files (Unattend.xml), IIS configuration files (web.config), WiFi profiles, and PowerShell history files.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote payloads and scripts:
Using 'cmstp.exe' to load a remote '.sct' payload from an external URL ('http://attacker_ip/payload.sct').
Using Netcat ('nc.exe') to execute 'cmd.exe' and redirect it to a remote listener.
Instructions for executing malicious DLLs via the Print Spooler service.
[EXTERNAL_DOWNLOADS]: The skill references and encourages the download of numerous third-party offensive security tools from GitHub, including WinPEAS, PowerUp, Seatbelt, and various Potato exploits. It also references 'hacktricks.xyz', which is flagged as a malicious domain by security scanners.
[PERSISTENCE]: Instructions for establishing persistence are included:
Creating new local administrator users via malicious DLLs.
Abusing registry autorun keys ('HKLM...\Run') and scheduled tasks ('schtasks /create') to maintain access.
[DYNAMIC_EXECUTION]: The skill includes C source code for malicious DLLs and provides compilation strings for generating executable binaries at runtime using 'mingw32-gcc'.
[COMMAND_EXECUTION]: Extensive use of 'sc.exe', 'reg.exe', 'schtasks.exe', and 'wmic' to manipulate system configuration and execute arbitrary code under elevated contexts.

offensive-windows-privesc