WinPEAS

Download and upload to target

From evil-winrm:

upload /kali/winPEASx64.exe

Run and save output

.\winPEASx64.exe | Out-File C:\Windows\Temp\winpeas_out.txt

.\winPEASx64.exe fast    # Faster, less thorough

.\winPEASx64.exe all     # Thorough, slower

Reading WinPEAS output · RED = exploitable, focus on:

- SeImpersonatePrivilege / SeAssignPrimaryToken

- AlwaysInstallElevated

- Unquoted service paths

- Writable service paths

- AutoLogon credentials

- Unattend.xml / sysprep

- DLL hijacking opportunities

- Scheduled tasks with writable paths

- Stored credentials

Download: github.com

winPEASx64.exe · 64-bit systems

winPEASx86.exe · 32-bit systems

winPEAS.bat · if .exe blocked by AV