E-WIN
winPEAS
Windows enumeration script that surfaces local privilege-escalation vectors: misconfigured services, credentials, and more.
OVERVIEW
winPEAS, part of the PEASS-ng monorepo, is a Windows enumeration script that checks dozens of categories in one pass: services, scheduled tasks, registry autoruns, installed software, credentials left in files or memory, AlwaysInstallElevated, unquoted service paths, token privileges, and more. Output is color-coded (highlighting likely findings in yellow/red) so an analyst can scan a long report quickly instead of reading it line by line.
It ships as a standalone .exe/.bat or a PowerShell/C# loader, and pairs with linPEAS and the shared PEASS-ng notation, so a team running both Windows and Linux hosts in the same engagement gets a consistent report format across platforms.
USE CASES
Practical use cases
- 01
Running a first automated privilege-escalation sweep right after landing a shell on a Windows host.
- 02
Spotting stored credentials in files, registry, memory, or configuration left behind by other software.
- 03
Identifying modifiable services, unquoted paths, and weak permissions worth escalating manually.
- 04
Cross-checking manual privesc findings against an independent automated pass before reporting.
QUICK START
On a Windows host with a shell already established, to run a broad automated sweep for local privilege-escalation vectors before searching manually.
- Confirm local privilege-escalation enumeration is authorized on this host.
- Get winPEAS.exe (or the .bat variant) onto the target, or load it reflectively if scope allows.
- Run it and let the full check pass complete.
- Scan the color-coded output for yellow/red highlights first, then triage each one manually.
winPEASx64.exe quiet cmd fastBEFORE YOU RUN IT
What to check before running it
winPEAS is signature-detected by most AV/EDR products and its output volume alone can be a giveaway on a monitored host — consider the .bat variant or in-memory execution if stealth matters.
It only reports what its checks are coded to look for; a fully patched host with a logic-based or zero-day privesc path can come back clean.
The full report can be long and noisy: treat every highlighted finding as a lead to validate manually, not a confirmed vulnerability.