winpeas

Name: winpeas
Availability: InStock
Author: Dave

Enumerate Windows privilege escalation vectors via service misconfigurations and stored credentials.

15|1|Updated Feb 12, 2026

Search Tags:#security #privilege escalation #windows #enumeration #post-exploitation #winpeas

Ready to run

npx skills add https://github.com/AeonDave/malskill --skill winpeas

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: winpeas
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/privilege-escalation/winpeas
Command: npx skills add https://github.com/AeonDave/malskill --skill winpeas

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of identifying potential privilege escalation vulnerabilities on Windows systems, helping security professionals and red teamers quickly find misconfigurations and exploitable vectors.

Core Features & Use Cases

Comprehensive Enumeration: Checks for common misconfigurations like unquoted service paths, AlwaysInstallElevated, writable registry keys, and more.
Credential Discovery: Attempts to find stored credentials and sensitive information.
Use Case: After gaining initial access to a Windows machine with low privileges, run WinPEAS to quickly surface potential paths to elevate your privileges to administrator.

Quick Start

Execute the winPEASx64.exe tool to begin privilege escalation enumeration.

Frequently Asked Questions about winpeas

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate Windows privilege escalation enumeration after gaining initial access?▼

Privilege escalation enumeration on Windows checks for service misconfigurations, unquoted service paths, AlwaysInstallElevated settings, and writable registry keys. It scans for exploitable vectors and stored credentials to identify paths from low-privilege user to administrator.

What's the best way to find stored credentials and misconfigurations for Windows post-exploitation?▼

The best way to find stored credentials during Windows post-exploitation is running comprehensive enumeration scripts that scan for writable registry keys, token privileges, and service misconfigurations. This surfaces sensitive information and exploitable vectors to elevate privileges on the target machine.

How do I run winPEAS to check for unquoted service paths and AlwaysInstallElevated settings?▼

To run winPEAS for checking unquoted service paths and AlwaysInstallElevated settings, execute the compiled winPEASx64.exe tool on the target Windows machine. This automates the enumeration of service misconfigurations and registry keys during post-exploitation.

Does Windows privilege escalation enumeration trigger antivirus detection?▼

Yes, Windows privilege escalation enumeration may trigger antivirus detection. Executing compiled .exe or PS1 enumeration scripts that scan for stored credentials, writable registry keys, and service misconfigurations often generates security alerts on protected systems.

Can I use PowerShell scripts for Windows privilege escalation checks if I only have low-privilege access?▼

Yes, you can use PS1 PowerShell scripts for Windows privilege escalation checks with low-privilege access. These scripts enumerate token privileges, service misconfigurations, and writable registry keys to identify potential vectors for elevating your permissions to administrator.