mirror of
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite.git
synced 2025-12-25 01:09:01 +00:00
33 lines
1.9 KiB
Markdown
Executable File
33 lines
1.9 KiB
Markdown
Executable File
# Windows Privilege Escalation Awesome Script (.ps1)
|
|
|
|
|
|
|
|
**WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on [book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html)**
|
|
|
|
Check also the **Local Windows Privilege Escalation checklist** from **[book.hacktricks.wiki](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html)**
|
|
|
|
## Mantainer
|
|
|
|
The official **maintainer of this script is [RandolphConley](https://github.com/RandolphConley)**.
|
|
|
|
## Quick Start
|
|
|
|
Download the **[latest releas from here](https://github.com/peass-ng/PEASS-ng/releases/latest)**.
|
|
|
|
|
|
```bash
|
|
powershell "IEX(New-Object Net.WebClient).downloadString('https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1')"
|
|
```
|
|
|
|
|
|
## Recent Updates
|
|
|
|
- Added Active Directory awareness checks to highlight Kerberos-only environments (NTLM restrictions) and time skew issues before attempting ticket-based attacks.
|
|
- winPEAS.ps1 now reviews AD-integrated DNS ACLs to flag zones where low-privileged users can register/modify records (dynamic DNS hijack risk).
|
|
- Enumerates high-value SPN accounts and weak gMSA password readers so you can immediately target Kerberoastable admins or abused service accounts.
|
|
- Surfaces Schannel certificate mapping settings to warn about ESC10-style certificate abuse opportunities when UPN mapping is enabled.
|
|
|
|
## Advisory
|
|
|
|
All the scripts/binaries of the PEAS Suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own networks and/or with the network owner's permission.
|