The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides comprehensive instructions for elevating privileges from a standard user to Administrator or SYSTEM. This includes exploiting unquoted service paths, weak service permissions using accesschk.exe, and performing token impersonation attacks (JuicyPotato, PrintSpoofer, RoguePotato, GodPotato). It also guides the agent in identifying and leveraging kernel vulnerabilities (e.g., MS17-010, CVE-2021-1732).
[DATA_EXFILTRATION]: The skill facilitates the discovery and exposure of sensitive local data and credentials. It provides methods to dump the SAM and SYSTEM registry hives to extract password hashes, query the registry for stored passwords (Autologon, PuTTY, VNC), and search the file system for configuration files (unattend.xml, sysprep.inf) and PowerShell command history (ConsoleHost_history.txt) which often contain plaintext secrets.
[COMMAND_EXECUTION]: The instructions involve executing high-privilege system commands and scripts to modify the environment. Examples include using sc config to change service binary paths to point to malicious payloads, and using msiexec to install malicious MSI files created with msfvenom.

windows-privilege-escalation