The first time you run WinPEAS, it prints roughly three thousand lines and you have no idea which four of them matter. That is the real skill this tool demands, and almost nobody teaches it. Downloading the binary takes ten seconds. Learning to read what it prints is the part that turns a shell into SYSTEM. This guide covers how to use WinPEAS properly: picking the right binary out of the four on the releases page, getting the colors to render, reading the legend the way the tool intends, filtering the output down to the checks you need, and recognizing the findings that win Windows boxes in practice. Follow along in HackerDNA's Windows Privilege Escalation course, which has a chapter dedicated to automated enumeration.
WinPEAS is one half of PEASS-ng, the project that also ships LinPEAS. It sits at the enumeration stage of privilege escalation: you already have a low-privilege foothold, and you need to know what on this host can be abused to get a higher one. Everything below is checked against the current PEASS-ng release, tagged 20260914-474d0061 and published on 14 September 2026.
TL;DR: WinPEAS is a C# enumeration binary that scans a Windows host for privilege escalation paths and color-codes what it finds. Grab winPEASany.exe from the PEASS-ng releases page, run REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1 first so the colors render, then launch it with log so you keep a copy. Red means a misconfiguration or a privilege you hold. Green means a defense is working. Read the red under Token Privileges, Services, Scheduled Tasks and Windows Credentials before you read anything else.
What Is WinPEAS?
WinPEAS is a Windows enumeration tool that searches a host for privilege escalation paths and prints its findings color-coded by whether they help an attacker or a defender. It is the Windows half of PEASS-ng (Privilege Escalation Awesome Scripts Suite, Next Generation), maintained by Carlos Polop and contributors at github.com/peass-ng/PEASS-ng.
Under the hood it is a C# program built on the check library from GhostPack's SeatBelt. SeatBelt gathers host data. WinPEAS adds opinion on top of it, and that opinion is the entire value proposition. Any competent operator can run whoami /priv, sc query and schtasks /query by hand. What nobody can do quickly is cross-reference two hundred results against the patterns that have historically led to SYSTEM.
One thing the download page does not say loudly enough: WinPEAS is in every antivirus signature database on earth. Windows Defender will quarantine winPEASany.exe within seconds of it touching disk on a default-configured machine. Security software detected it, which is exactly what you would expect from a well-known offensive tool in a protected environment. In a lab, add a folder exclusion and move on. On an authorized engagement, agree the approach with the client before you start, so nobody's SOC spends an afternoon triaging your enumeration script.
Which WinPEAS Binary Should You Download?
The releases page offers several files and the naming is not self-explanatory. Here is what each one is for.
winPEASany.exe- compiled for Any CPU, so it runs on both 32-bit and 64-bit hosts. Start here. It is the right answer most of the time and it saves you a round trip when you guessed the architecture wrong.winPEASx64.exe- 64-bit only. Use it when you already know the target is x64 and you want the process architecture to match the host.winPEASx86.exe- 32-bit only. The one you need on older boxes, and inside a 32-bit process under WOW64 where a 64-bit binary will not load.winPEAS.bat- a pure batch version with no .NET dependency and far fewer checks. Its job is to cover the case where the .exe will not run at all.
The .exe variants need .NET Framework 4.5.2 or later. Every Windows release from 8.1 onwards ships something newer, so this only bites on Windows 7 and Server 2008 R2 targets. If winPEASany.exe exits instantly with no output, missing .NET is the first thing to rule out. Run reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release; a Release value of 379893 or higher means 4.5.2 or newer is installed.
There is also a PowerShell version, winPEAS.ps1, and it is worth knowing that it is not published as a release asset. It lives in the repository tree and gets pulled from raw.githubusercontent.com. It covers less ground than the .exe, but it is the fallback worth remembering when application allowlisting blocks new executables and PowerShell is still available to you.
How to Run WinPEAS
Before anything else, fix the colors. WinPEAS emits ANSI escape sequences and a stock Windows console does not interpret them. Skip this step and you get a screen full of [1;31m noise with the priority information stripped out, which is the single most common reason beginners give up on the tool.
REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1The change only applies to consoles opened after you set it, so close the window and open a new cmd.exe. Windows Terminal handles ANSI natively and needs nothing. If you are working through a reverse shell rather than an interactive console, colors will not survive the hop either way, so pass notcolor and rely on the section headers instead.
Then run it. With no arguments, WinPEAS executes every check except the slow ones:
.\winPEASany.exeIn practice you almost always want two extra words on that line:
.\winPEASany.exe quiet logquiet drops the ASCII-art banner. log writes everything to out.txt next to the binary, and you can point it somewhere else with log=C:\Users\Public\peas.txt. Logging matters more than it sounds: a default run takes a couple of minutes, output overruns the console scrollback on most hosts, and on an engagement the raw output belongs in your report appendix anyway.
Three other flags earn their keep. wait pauses between checks, which is genuinely useful the first few times you run the tool because it stops the output racing past you. debug prints per-check execution time and memory, handy when one check hangs on a network share and you want to know which. searchpf extends the credential regex hunt into Program Files, worth a second pass on application servers where the interesting configuration files live under an installed product.
How to Read WinPEAS Output: the Color Legend
WinPEAS prints its legend at the top of every run, and most people scroll straight past it. Reading it once saves hours. The five colors are not a severity ramp. They are five different kinds of statement.
- Red - a special privilege you hold over an object, or something misconfigured. This is your work queue.
- Green - a protection is enabled or something is well configured. Green is written for the defender reading the report, not for you.
- Cyan - active users.
- Blue - disabled users.
- Light yellow - links to the HackTricks documentation for that check.
Note what is absent. Unlike LinPEAS, WinPEAS has no red-on-yellow "95% confidence" tier and no summary of top findings at the end of the run. Every red line carries equal visual weight, whether it is a writable service binary that hands you SYSTEM or a Defender exclusion path that is merely interesting. Prioritising is your job, not the tool's, and that difference catches out people who learned the Linux side first.
Section headers are the other navigation aid. Each one prints as a cyan banner of box-drawing characters wrapping a green title, and since the current release most also carry the relevant MITRE ATT&CK technique ID in grey. The Current Token Privileges section, for example, is tagged T1134.001. When you are reading a saved out.txt, searching for those banner characters is the fastest way to jump between sections.
Run Only the Checks You Need
The flag most WinPEAS tutorials never mention is that you can name the check groups you want as bare arguments, and the tool runs only those. On a slow box or a noisy engagement this turns a two-minute scan into a five-second one.
.\winPEASany.exe systeminfo userinfo servicesinfo quietThe groups are systeminfo, userinfo, processinfo, servicesinfo, applicationsinfo, networkinfo, eventsinfo, windowscreds, registryinfo, browserinfo, filesinfo, cloudinfo, domain and activedirectoryinfo. Two more sit outside the default run: fileanalysis, which greps file contents for credentials and adds several minutes, and networkscan, which port-scans hosts it discovers. Passing all runs everything including fileanalysis.
The newest addition is a MITRE filter, and it is the flag worth learning:
.\winPEASany.exe mitre=T1134,T1053 quiet logThat runs only the checks mapped to those ATT&CK technique IDs, in this case token manipulation and scheduled tasks. Two uses. On a red team engagement with agreed technique scope, you run exactly what the rules of engagement allow and nothing else. On a purple team exercise, you point it at the technique the blue team is trying to detect and see whether the enumeration alone lights up their dashboard. The full technique catalog is at MITRE's Privilege Escalation tactic page.
A word of warning on two flags. -vulnpackages sends your installed application names and versions to an online HackTricks lookup, and -linpeas downloads and runs linpeas.sh inside the default WSL distribution. Both are outbound network from the target host. Neither belongs on a client system unless you have cleared it in writing.
The Findings That Actually Win Boxes
Four sections of WinPEAS output produce most real escalations. Learn what a win looks like in each and you can triage a full run in about ninety seconds.
Token Privileges
Scroll to "Current Token privileges" first, every time. WinPEAS flags nine privileges in red, and the two you will meet most often are SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege. Service accounts hold them by default, which is why a web shell on IIS so often ends in SYSTEM. SeBackupPrivilege and SeRestorePrivilege let you read any file on disk, including the registry hives holding password hashes. SeDebugPrivilege and SeLoadDriverPrivilege are rarer and just as fatal. The mechanics of turning each one into a shell are covered in our guide to Windows privilege escalation techniques.
Services
The services section is the densest part of the output and the one worth slowing down for. Three patterns appear in red. A modifiable service, where your user can reconfigure the service binary path and restart it. A writable service registry binpath, which reaches the same result through the registry instead of the service control manager. And the classic unquoted service path, which WinPEAS labels with the literal string No quotes and Space detected. That exact phrase is worth memorising, because it is what you search for in a saved log.
Unquoted paths only matter when you can write to one of the directories the path expands into, and WinPEAS tells you that in the same row: it prints the file rights and the directory rights it found alongside the service. A service at C:\Program Files\Acme Backup\agent.exe is harmless unless C:\Program Files\Acme is somewhere you can drop a file.
Scheduled Tasks and AutoRuns
The applications section lists scheduled tasks and highlights writable execution targets in tasks that run as SYSTEM, plus AutoRun entries from the registry. The question to ask is always the same one: does something privileged execute a file that I can replace? A SYSTEM task pointing at a script in a directory your user can write to is the cleanest escalation on Windows, because it needs no exploit and no race condition. You wait for the schedule.
Windows Credentials
The credentials section is where an engagement turns from privilege escalation into lateral movement. WinPEAS checks the Windows Vault and Credential Manager, saved RDP settings, PowerShell transcripts, DPAPI material, Kerberos tickets, saved WiFi keys, unattended install files, cached Group Policy Preferences passwords, and exposed SAM, SECURITY and SYSTEM hives in live ACLs, backups and shadow copies. That last one is the jackpot: readable hives mean offline hash extraction, and a local administrator hash is frequently valid on the next host too. Practice the extraction half in the Windows Password Cracker lab.
WinPEAS vs LinPEAS vs Doing It by Hand
The choice between WinPEAS and LinPEAS is not a preference, it is an operating system. If systeminfo returns, run WinPEAS. If uname -a returns, run LinPEAS instead. The two tools share a project and a philosophy, but the privilege escalation surfaces barely overlap: tokens and services and the registry on one side, SUID binaries and sudo rules and cron on the other. Learning one gives you the habit, not the knowledge.
The more interesting question is when to skip WinPEAS entirely. Three situations. When the host has EDR you have not cleared with the client and enumeration noise would burn the engagement. When .NET is missing or restricted and the batch version covers too little to be worth the upload. And when you already know what you are looking for, in which case whoami /priv and one sc qc answer the question faster than a full scan.
Beyond that, run it. The honest argument for automated enumeration is not that it finds things you could not find manually. It is that it finds them in the same order every time, on your fortieth box at two in the morning, when you would otherwise forget to check the Credential Manager. For where WinPEAS sits among the rest of the kit, our roundup of penetration testing tools walks through the full workflow.
Legal and Ethical Considerations
Critical reminder: Always get explicit written authorization before running WinPEAS against any system. Enumeration is still unauthorized access when you do not have permission, under the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK, and equivalent legislation nearly everywhere else.
- Run WinPEAS only on systems you own, on lab targets, or on hosts explicitly in scope for an engagement you have signed paperwork for.
- Download only from the official PEASS-ng releases page. Enumeration tools are a popular thing to backdoor precisely because people run them with the privileges they are trying to escalate from.
- Clear
-vulnpackages,-linpeasandnetworkscanwith the client first. All three generate outbound traffic from the target, and the last one port-scans neighboring hosts that may be out of scope. - Clean up. The binary and any
out.txtyou wrote are your artifacts to remove, and their locations belong in the report. - Tell the client that Defender will alert. An unannounced quarantine event costs a SOC analyst an afternoon and costs you their goodwill.
Frequently Asked Questions
Why is WinPEAS showing strange characters instead of colors?
Your console is not interpreting ANSI escape sequences. Run REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1, then close the console and open a new one. Windows Terminal supports ANSI without any change. Over a plain reverse shell colors will not render at all, so pass notcolor and navigate by section header instead.
Which WinPEAS file should I download?
winPEASany.exe. It is compiled for Any CPU and runs on 32-bit and 64-bit hosts alike, so you do not need to know the target architecture first. Use winPEASx86.exe inside a 32-bit process, and fall back to winPEAS.bat only when .NET 4.5.2 is unavailable, accepting that the batch version checks far less.
Does Windows Defender block WinPEAS?
Yes, on a default configuration. WinPEAS is a widely known offensive tool and sits in standard signature sets, so Defender typically quarantines it on write. That is the expected outcome in a protected environment. In a lab, add a folder exclusion. On an engagement, agree the approach with the client in advance rather than working around their controls unannounced.
How long does a WinPEAS scan take?
A default run finishes in about one to three minutes on a typical host. Most of that is the file search near the end. Adding fileanalysis, or passing all, greps file contents for credentials and can add several minutes depending on how much sits in user home directories. Naming specific check groups, such as userinfo servicesinfo, cuts a run to a few seconds.
Where can I practice Windows privilege escalation legally?
HackerDNA's Windows Privilege Escalation course pairs each technique with a browser-based lab, so there is nothing to install and no VPN to configure. The Registry Hunter and Windows Password Cracker labs cover the registry and credential surfaces WinPEAS reports on. Building your own Windows VM and deliberately misconfiguring a service is the other good option, and it teaches you what the defender sees.
Your Next Steps
Knowing how to use WinPEAS is really two skills. The first is mechanical and takes an afternoon: pick winPEASany.exe, set the console registry key, run it with quiet log, name check groups when you need speed. The second takes repetition, because Windows privilege escalation lives in the gap between a red line and a working path to SYSTEM, and only pattern recognition closes it. Build that by running WinPEAS on boxes where you already know the answer, then on boxes where you do not. Start free on HackerDNA, no credit card required: run the Registry Hunter lab, then work through the Windows Privilege Escalation course chapter by chapter. Forty boxes from now you will read a WinPEAS dump in ninety seconds and wonder why it ever looked like a wall of text.
Part of the Privilege Escalation series
Related articles:
