Winpeas

WinPEAS

Purpose

Use this skill for host-local Windows privilege-escalation enumeration when the engagement includes approved access to a specific Windows system.

Phase Fit

• Primary: Vulnerability Analysis
• Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

Use When

• Need to enumerate Windows misconfigurations or local escalation paths.
• Need a structured checklist for host-local privilege review.
• Need a repeatable retest after Windows hardening.

Avoid When

• Host-local enumeration is not explicitly approved.
• The host is too sensitive for broad scripted checks.

Inputs

• Approved Windows host and user context
• Execution and logging constraints
• Output handling requirements

Procedure

1. Confirm the host and privilege boundary under review.
2. Run only within the approved host scope.
3. Triage results for practical, reachable escalation paths.
4. Manually validate material findings before escalation.
5. Preserve the exact host and execution context for retest.

Command Syntax

Replace sample paths with the approved local binary path.

:: Standard 64-bit run
winPEASx64.exe

:: Quiet mode (less output noise)
winPEASx64.exe quiet

:: Run all checks and redirect output
winPEASx64.exe > C:\temp\winpeas_output.txt

:: Run system-focused checks only
winPEASx64.exe systeminfo

:: PowerShell version
.\winPEAS.ps1 | Tee-Object C:\temp\winpeas-ps.txt

Evidence to Capture

• Practical Windows privilege-escalation paths or misconfigurations
• Exact host and user context used
• Minimal proof needed for remediation

Safety Boundaries

• Use only on approved hosts.
• Treat output as sensitive host evidence and avoid unnecessary state changes.