> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/windows-privilege-escalation/winpeas.md). # WinPEAS WinPEAS (Windows Privilege Escalation Awesome Scripts) is the Windows version of [PEASS-ng](https://github.com/peass-ng/PEASS-ng) (Privilege Escalation Awesome Scripts SUITE new generation). ## General information ### Implementations WinPEAS comes in three different implementations, each optimized for different deployment scenarios:
ImplementationTechnologyKey FeaturesUse Case
winPEAS.exeC# (.NET 4.5.2+)Full feature set, obfuscation supportPrimary implementation
winPEAS.ps1PowerShellIn-memory execution, Excel searchPowerShell environments
winPEAS.batBatch ScriptMinimal dependencies, legacy supportOlder Windows systems
### Color Coded Output The output system uses ANSI color codes for threat classification: * **Red**: Security issues or misconfigurations * **Green**: Properly configured security settings * **Yellow**: Informational or warning items * **Cyan**: Active user accounts * **Blue**: Disabled user accounts * **Magenta**: Current user context ## Different checks By default, these checks are executed in the following order: #### System Information Run this section with `winpeasany.exe systeminfo` * Basic System Information * Showing All Microsoft Updates * System Last Shutdown Date/time (from Registry) * User Environment Variables * System Environment Variables * Audit Settings * Audit Policy Settings - Classic & Advanced * WEF (Windows Event Forwarding) Settings * LAPS (Local Administrator Password Solution) Settings * Wdigest * [LSA Protection](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#lsa-protection) * [Credentials Guard](https://hacktricks.wiki/en/windows-hardening/stealing-credentials/credentials-protections.html#credentials-guard) * [Cached Creds](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#cached-credentials) * Enumerating saved credentials in Registry (CurrentPass) * AV Information * Windows Defender configuration * UAC Status * PowerShell Settings * Enumerating PowerShell Session Settings using the registry * PS default transcripts history * HKCU Internet Settings * HKLM Internet Settings * Drives Information * Checking WSUS * Checking KrbRelayUp * Checking If Inside Container * [Checking AlwaysInstallElevated](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated) * Object Manager race-window amplification primitives * Enumerate LSA settings - auth packages included * Enumerating NTLM Settings * Display Local Group Policy settings - local users/machine * Potential GPO abuse vectors (applied domain GPOs writable by current user) * Checking AppLocker effective policy * PrintNightmare PointAndPrint Policies * Enumerating Printers (WMI) * Enumerating Named Pipes * Named Pipes with Low-Priv Write Access to Privileged Servers * Enumerating AMSI registered providers * Enumerating Sysmon configuration * Enumerating Sysmon process creation logs (1) * Installed .NET versions ### Users Information * Users * Current Token privileges * Clipboard text * Logged users * RDP Sessions * Ever logged users * Looking for AutoLogon credentials * Home folders found * Password Policies ### Processes Information * Interesting Processes -non Microsoft- ### Services Information Run this section with `winpeasany.exe servicesinfo` * [Interesting Services](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services) -non Microsoft- * [Modifiable Services](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services) * [Looking if you can modify any service registry](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services-registry-modify-permissions) * [Checking write permissions in PATH folders (DLL Hijacking)](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dll-hijacking/index.html) * OEM privileged utilities & risky components * Kernel drivers with weak/legacy signatures * KernelQuick / ValleyRAT rootkit indicators ### Applications Information * Current Active Window Application * Installed Applications --Via Program Files/Uninstall registry-- * Autorun Applications * Scheduled Applications --Non Microsoft-- ### Network Information * Network Shares * Host File * Network Ifaces and known hosts * Current Listening Ports * Firewall Rules * DNS cached --limit 70-- ### Windows Credentials Run this section with `winpeasany.exe windowscreds` * [Checking Windows Vault](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault) * [Checking Credential manager](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault) * Saved RDP connections * Recently run commands * [Checking for DPAPI Master Keys](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi) * [Checking for DPAPI Credential Files](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi) * [Checking for RDCMan Settings Files](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#remote-desktop-credential-manager) * [Looking for kerberos tickets](https://hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html) * Looking saved Wifis * [Looking AppCmd.exe](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe) * [Looking SSClient.exe](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#scclient--sccm) * Enumerating SSCM - System Center Configuration Manager settings * Enumerating Security Packages Credentials ### Browsers Information * Looking for Firefox DBs * Looking for GET credentials in Firefox history * Looking for Chrome DBs * Looking for GET credentials in Chrome history * Chrome bookmarks * Current IE tabs * Looking for GET credentials in IE history * IE favorites ### Interesting files and registry * Putty Sessions * Putty SSH Host keys * SSH keys in registry * Cloud Credentials * Unattend Files * Looking for common SAM & SYSTEM backups * Looking for McAfee Sitelist.xml Files * Cached GPP Passwords * Looking for possible regs with creds * Looking for possible password files in users homes * Looking inside the Recycle Bin for creds files * Searching known files that can contain creds in home * Looking for documents --limit 100-- * Recent files --limit 70-- ## Usage information By default **all checks** (except CMD checks) are executed.
winPEAS.exe --help ```bat C:\PrivEsc>winPEASany.exe --help [*] WinPEAS is a binary to enumerate possible paths to escalate privileges locally quiet Do not print banner searchfast Avoid sleeping while searching files (notable amount of resources) searchall Search all known filenames whith possible credentials (coul take some mins) cmd Obtain wifi, cred manager and clipboard information executing CMD commands notansi Don't use ansi colors (all white) systeminfo Search system information userinfo Search user information procesinfo Search processes information servicesinfo Search services information applicationsinfo Search installed applications information networkinfo Search network information windowscreds Search windows credentials browserinfo Search browser information filesinfo Search files that can contains credentials [+] By default all checks (except CMD checks) are executed ```
## Resources PEASS-ng - GitHub: Winpeas - 1337Skills: [https://1337skills.com/cheatsheets/winpeas](https://1337skills.com/cheatsheets/winpeas/) WinPEAS - DeepWiki: winPEAS - GitHub: