JEA Endpoint Escape – Breaking Out of Just Enough Administration

Just Enough Administration (JEA) is a PowerShell remoting configuration that locks a WinRM session to a whitelist of specific commands, typically running as a high-privilege virtual account in the background. The user connects with low or no privileges but the commands they are allowed to run execute as SYSTEM or a service account behind the scenes. A misconfigured JEA endpoint is a direct path to SYSTEM.

Recognising a JEA Session

Connect with evil-winrm as normal. If you land in a JEA endpoint rather than a full shell:

The prompt looks normal but most commands fail. The immediate tell:

A full PowerShell session returns hundreds of commands. A JEA session returns a short, curated list — often fewer than 20. Also check:

NoLanguage confirms a JEA session. ConstrainedLanguage may also indicate a restricted endpoint.

Enumerating the JEA Configuration

List every command available to you:

Check for command parameters in detail — parameters are often the attack surface:

Read the session configuration if you can access it:

Check the role capability files if accessible on disk — they define exactly what is permitted:

Role capability files (.psrc) contain VisibleCmdlets, VisibleFunctions, VisibleExternalCommands, and ScriptBlocks entries. Reading one directly reveals exactly what the JEA policy allows.

Technique 1 – Script Block Abuse

If script blocks are permitted in the session configuration, you can define and call arbitrary PowerShell in the context of the underlying high-privilege account:

If this returns a privileged account name (e.g. nt authority\system or a service account), the JEA endpoint is running as that principal. Escalate immediately:

Or get a reverse shell:

Technique 2 – Parameter Injection via Allowed Cmdlets

Many JEA configurations allow helpdesk-style cmdlets that take a Path, FilePath, or ScriptBlock parameter. If any allowed command accepts a file path or script block parameter, inject through it.

Example — if Restart-Service is allowed:

Look for -PassThru, -Confirm, or anything that might trigger a script. Some administrative cmdlets allow -Before or -After script hooks.

If Start-Process is allowed:

If Copy-Item is allowed and you can write to a privileged path:

Then trigger execution via any allowed command that runs executables.

Technique 3 – Function Definition Escape

If the JEA endpoint allows defining functions but restricts language mode, try defining a function that wraps a restricted operation:

Some JEA implementations check the top-level command name but not nested script blocks inside permitted functions.

Technique 4 – Connecting to an Unrestricted Endpoint

A server often has multiple WinRM endpoints registered — the default restricted JEA endpoint is configured by name but the default microsoft.powershell endpoint may still exist and accept connections from your account:

List registered endpoints (if Get-PSSessionConfiguration is available):

Connect to the default unrestricted endpoint explicitly:

Or with Enter-PSSession specifying the ConfigurationName:

If the default endpoint is accessible to your account, it bypasses the JEA restriction entirely.

Technique 5 – Abusing RunAs Virtual Account

JEA endpoints that use RunAsVirtualAccount = $true in their session configuration execute all commands as a local administrator or SYSTEM. If you can identify what the virtual account can do, you can escalate through any permitted command.

Check which account your commands run as:

If the output is nt authority\system or a privileged local account, any command parameter abuse above immediately yields SYSTEM access.

Post-Escape Verification

After escaping, confirm full language mode and privilege:

Load tools from memory: