# Winpeas

> Use for Windows privilege-escalation enumeration during authorized pentests. Trigger on approved Windows host review, local misconfiguration discovery, and identifying practical privilege-escalation paths on a specific system.

- Skill: `timsonner/winpeas` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/winpeas`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/winpeas/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/winpeas

---


# WinPEAS

## Purpose

Use this skill for host-local Windows privilege-escalation enumeration when the engagement includes approved access to a specific Windows system.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to enumerate Windows misconfigurations or local escalation paths.
- Need a structured checklist for host-local privilege review.
- Need a repeatable retest after Windows hardening.

## Avoid When

- Host-local enumeration is not explicitly approved.
- The host is too sensitive for broad scripted checks.

## Inputs

- Approved Windows host and user context
- Execution and logging constraints
- Output handling requirements

## Procedure

1. Confirm the host and privilege boundary under review.
2. Run only within the approved host scope.
3. Triage results for practical, reachable escalation paths.
4. Manually validate material findings before escalation.
5. Preserve the exact host and execution context for retest.

## Command Syntax

Replace sample paths with the approved local binary path.

```cmd
:: Standard 64-bit run
winPEASx64.exe

:: Quiet mode (less output noise)
winPEASx64.exe quiet

:: Run all checks and redirect output
winPEASx64.exe > C:\temp\winpeas_output.txt

:: Run system-focused checks only
winPEASx64.exe systeminfo

:: PowerShell version
.\winPEAS.ps1 | Tee-Object C:\temp\winpeas-ps.txt
```

## Evidence to Capture

- Practical Windows privilege-escalation paths or misconfigurations
- Exact host and user context used
- Minimal proof needed for remediation

## Safety Boundaries

- Use only on approved hosts.
- Treat output as sensitive host evidence and avoid unnecessary state changes.