Post Exploitation
WinPEAS is a script designed to discover local privilege escalation paths on Windows environments. It audits configurations, user security rights, system vulnerabilities, and active processes.
Download binary compilation from the authorized PEASS-ng repository build listings
winpeas.exe [options]
WinPEAS is the essential privilege escalation enumeration tool for Windows systems. It performs comprehensive checks for misconfigurations, insecure permissions, and credential exposures that can be exploited to elevate privileges.
From unquoted service paths to AlwaysInstallElevated policies, WinPEAS detects the most common and dangerous Windows privilege escalation vectors with its familiar color-coded output.
winPEASx64.exeRun the 64-bit binary with all default privilege-escalation checkswinPEASx86.exeRun the 32-bit binary for x86 hosts or 32-bit process contextswinPEASany.exeRun the AnyCPU .NET build when architecture is unknownwinPEAS.batRun the batch-script fallback when the .NET runtime is missingwinpeas.exe helpPrint usage, available arguments and check categorieswinpeas.exe quietSuppress the ASCII banner and startup infowinpeas.exe notcolorDisable ANSI color codes for clean file/log capturewinpeas.exe logLog all output to the default out.txt in the current directorywinpeas.exe log=C:\Windows\Temp\out.txtLog output to a specific file pathwinpeas.exe waitPause for user input between each check sectionwinpeas.exe debugShow debugging information and wait for input at the endwinpeas.exe fastSkip time-consuming filesystem searches for a quicker runwinpeas.exe cmdGather extra info by executing known Windows commands (slower)winpeas.exe domainPerform Active Directory / domain-related enumeration checkswinpeas.exe systeminfoRun only the system information and patch-level checksFind weak service permissions and paths.
Identify exploitable token privileges (SeImpersonate, SeAssignPrimaryToken).
Find passwords in files, registry, and configs.
Check AlwaysInstallElevated and autologon.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.