Investigation Tools and References

These tools help investigate a local Windows environment, and the references provide more detailed procedures. Compare tool output with the rights and settings you verified manually.

Tools to Run on the Target Host

Tool	Main use
WinPEAS / winPEASbat	Enumerate a broad range of local privilege escalation leads.
PrivescCheck, PowerUp	Check misconfigurations and writable targets with PowerShell.
JAWS, WindowsEnum	Collect host and user information.
Seatbelt, SharpUp	Check host information and privilege escalation candidates with executables.
Watson	Look for known vulnerabilities related to the OS and patches.
SessionGopher, Invoke-WCMDump, LaZagne	Check saved sessions and credentials.
Inveigh, DomainPasswordSpray	Investigate name resolution and domain authentication.

privesc, Sherlock, WINspect, BeRoot, and Windows-Privesc-Check are also useful references. Before using older tools, check the target Windows version and the rights they require.

Tools for Analyzing Results Locally

• Windows-Exploit-Suggester and wesng: Analyze systeminfo output locally.
• Static Impacket binaries: Check how the needed commands are distributed.
• Meterpreter’s multi/recon/local_exploit_suggester: Enumerate local candidates.

When using .NET tools, also check the .NET version on the target host. A mismatched build version can cause execution to fail.

C:\Windows\microsoft.net\framework\v4.0.30319\MSBuild.exe -version

References

• HackTricks: Windows Local Privilege Escalation
• PayloadsAllTheThings: Windows Privilege Escalation
• Windows Privilege Escalation Workshop
• FuzzySecurity: Windows Privilege Escalation Fundamentals
• frizb: Windows Privilege Escalation
• HTB Reaper analysis
• Check Point Research: Chasing the Silver Fox