PE-POW
PowerUp
PowerShell script that enumerates and abuses common Windows privilege-escalation misconfigurations.
OVERVIEW
PowerUp.ps1, part of the (now archived) PowerSploit framework, is a PowerShell script that checks a Windows host for a long list of well-known local privilege-escalation misconfigurations: modifiable services, unquoted service paths, weak service binary/config permissions, AlwaysInstallElevated registry keys, DLL hijacking opportunities, and more.
Its Invoke-AllChecks function runs the full enumeration in one pass and reports which findings are exploitable, and several accompanying functions (like Invoke-ServiceAbuse) can perform the actual escalation once a viable path is confirmed.
USE CASES
Practical use cases
- 01
Running a full local privesc enumeration pass with Invoke-AllChecks after landing a low-privilege shell.
- 02
Identifying modifiable services or unquoted service paths that let a low-privileged user run code as SYSTEM.
- 03
Spotting AlwaysInstallElevated or weak file/registry permissions left by third-party software.
- 04
Automating the abuse of a confirmed misconfiguration once the client authorizes exploitation.
QUICK START
On a Windows host with a low-privilege shell already established, to enumerate and optionally abuse common local privilege-escalation misconfigurations.
- Confirm local privilege-escalation testing is authorized on this host.
- Get PowerUp.ps1 onto the target or load it reflectively into the current session.
- Run Invoke-AllChecks and review which findings are marked exploitable.
- Validate one finding manually before using the matching abuse function, if exploitation is in scope.
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"BEFORE YOU RUN IT
What to check before running it
The PowerSploit repository is archived and no longer maintained; script-block logging and AMSI in modern PowerShell make unmodified execution easy to detect and often blocked outright.
Invoke-AllChecks only reports what it's coded to check for — always confirm manually before relying on a negative result.
Abuse functions restart services or write files: run them only once the client has authorized active exploitation, not just enumeration.