PowerUp (PowerSploit Privesc Module)

PowerUp is the local privilege-escalation module of PowerSploit, the PowerShell post-exploitation framework maintained by PowerShellMafia (principal author: Will Schroeder, @harmj0y). Per the project README, PowerUp “aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations” — it audits a host for weak service configurations, registry mistakes, leftover credential files, and DLL-hijack opportunities, then pairs each finding with an abuse function that weaponizes it. The upstream repository was archived on 2021-01-21 and is now read-only; the maintained spiritual successor for pure auditing is PrivescCheck (see windows-privesc-recon-scripts).

Usage model

PowerUp runs on the target host in PowerShell (v2 minimum). The audit sweep is:

Invoke-AllChecks -Verbose

which prints every identifiable vulnerability along with the corresponding abuse function’s invocation — the tool is deliberately self-documenting. A -HTMLReport flag (on Invoke-PrivescAudit, the renamed modern entry point) emits a COMPUTER.username.html report.

Service checks and abuse

The service family is the workhorse:

Check	Finds
Get-UnquotedService	Services with unquoted BINARY_PATH_NAME containing a space (the hijack documented in exploit-windows-services / unquoted-path-handling-in-windows)
Get-ModifiableServiceFile	Services whose binary path (or its config) is writable by the current user
Get-ModifiableService	Services whose configuration the current user can change (weak service DACLs)
Test-ServiceDaclPermission	Explicit DACL test against an arbitrary permission set

Abuse functions close the loop:

• Invoke-ServiceAbuse — modifies a vulnerable service to add a local admin user or run a custom command
• Write-ServiceBinary / Install-ServiceBinary / Restore-ServiceBinary — build, plant, and roll back a patched C# service binary
• Set-ServiceBinaryPath — repoint a service’s binary path directly

# Audit
Get-UnquotedService -Verbose
Get-ModifiableServiceFile -Verbose
Get-ModifiableService -Verbose
 
# Weaponize a modifiable service (default: add a local admin)
Invoke-ServiceAbuse -Name $VULNERABLE_SERVICE

Registry and credential checks

• Get-RegistryAlwaysInstallElevated — both HKLM and HKCU AlwaysInstallElevated values set means any MSI installs as SYSTEM; pair with Write-UserAddMSI
• Get-RegistryAutoLogon — plaintext autologon credentials in Winlogon
• Get-ModifiableRegistryAutoRun — HKLM autorun binaries/scripts writable by the current user (compare registry-run-keys-and-startup-folder)
• Get-UnattendedInstallFile — leftover unattend.xml/sysprep.inf with encoded credentials (see unattended-installation-credentials)
• Get-CachedGPPPassword — Group Policy Preferences cpassword values cached on the host (decryptable against Microsoft’s published AES key)
• Get-Webconfig / Get-ApplicationHost — encrypted strings in web.config and IIS applicationHost.config (see iis-configuration-credentials)
• Get-SiteListPassword — plaintext passwords in McAfee SiteList.xml

DLL hijacking

• Find-ProcessDLLHijack — running processes loading DLLs from writable locations
• Find-PathDLLHijack — service %PATH% hijack opportunities
• Write-HijackDll — emit a hijackable DLL payload

Token helpers

Get-ProcessTokenPrivilege, Get-ProcessTokenGroup, and Enable-Privilege enumerate and toggle privileges on the current process — the reconnaissance half of token-manipulation attacks.

Operational considerations

• Detection surface: PowerUp is heavily signatured. AMSI catches the stock script by name; the -exec bypass policy flag often needed to load it is itself high-signal telemetry (see windows-privesc-recon-scripts for the delivery trade-offs).
• PowerShell v2 compatibility was a deliberate design choice — the module works on legacy hosts where modern tooling fails (though downgrading to PSv2 is a well-known logging-evasion flag).
• Being archived, it receives no updates; several checks (e.g. GPP cpassword) target historical misconfigurations. PrivescCheck covers the modern check set without the weaponization functions.

Sources

• PowerSploit — Privesc Module
• PowerUp.ps1 — PowerSploit Privilege Escalation Script
• PowerSploit
• PrivescCheck

Related: windows-privesc-recon-scripts, exploit-windows-services, unattended-installation-credentials, iis-configuration-credentials, registry-run-keys-and-startup-folder