> ## Documentation Index > Fetch the complete documentation index at: https://docs.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # Compilation & Usage > Build and run SharpUp from source ## Build Requirements Visual Studio 2015 Community Edition or later .NET Framework 3.5 (required) For cloning the repository Windows build environment required ## Compilation Steps ```bash theme={null} git clone https://github.com/GhostPack/SharpUp cd SharpUp ``` Open `SharpUp.sln` in Visual Studio 2015 or later * Choose **Release** configuration (not Debug) * Target platform: **Any CPU** * Build → Build Solution (or press Ctrl+Shift+B) * SharpUp.exe will be compiled Compiled binary will be in: ``` SharpUp/SharpUp/bin/Release/SharpUp.exe ``` SharpUp is built against .NET Framework 3.5 for maximum compatibility with Windows systems. ## Binary Distribution No pre-compiled binaries are provided for SharpUp. You must compile from source. **Why no binaries?** * Encourages understanding of the code * Prevents signature-based detection * Allows for customization * Avoids potential legal issues ## Running SharpUp ```bash theme={null} # Run all checks SharpUp.exe # Run all checks in audit mode (bypasses privilege checks) SharpUp.exe audit # Run specific check SharpUp.exe ModifiableServices # Run multiple specific checks SharpUp.exe UnquotedServicePath ModifiableServiceBinaries # Run specific checks in audit mode SharpUp.exe audit TokenPrivileges RegistryAutoruns ``` You can load and execute SharpUp in memory via PowerShell: ```powershell theme={null} # Base64 encode the binary [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Path\SharpUp.exe")) | Out-File -Encoding ASCII SharpUp.txt # Load in PowerShell $SharpUpAssembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String((Get-Content SharpUp.txt))) # Execute command [SharpUp.Program]::Main(@("audit")) ``` Execute via Cobalt Strike or other frameworks: ``` # Run all checks execute-assembly /path/to/SharpUp.exe # Run all checks in audit mode execute-assembly /path/to/SharpUp.exe audit # Run specific checks execute-assembly /path/to/SharpUp.exe ModifiableServices UnquotedServicePath ``` ## Command Line Syntax ```bash theme={null} SharpUp.exe [audit] [check1] [check2]... ``` ### Parameters Enables audit mode, which runs vulnerability checks regardless of process integrity level or local administrator group membership. If no specific checks are provided after `audit`, all checks will be executed. Individual vulnerability check to run. Can specify multiple checks. Available checks: * AlwaysInstallElevated * CachedGPPPassword * DomainGPPPassword * HijackablePaths * McAfeeSitelistFiles * ModifiableScheduledTask * ModifiableServiceBinaries * ModifiableServiceRegistryKeys * ModifiableServices * ProcessDLLHijack * RegistryAutoLogons * RegistryAutoruns * TokenPrivileges * UnattendedInstallFiles * UnquotedServicePath ## Quick Start Examples ```bash theme={null} # Run all privilege escalation checks SharpUp.exe ``` SharpUp will automatically detect if you're already running in high integrity or are a local administrator, and will exit early unless audit mode is enabled. ```bash theme={null} # Run all checks regardless of current privileges SharpUp.exe audit ``` Useful for comprehensive security auditing, even when running with elevated privileges. ```bash theme={null} # Check for service-related vulnerabilities only SharpUp.exe ModifiableServices ModifiableServiceBinaries ModifiableServiceRegistryKeys UnquotedServicePath ``` Focus on service-related privilege escalation vectors. ```bash theme={null} # Check for registry-based vulnerabilities SharpUp.exe audit RegistryAutoLogons RegistryAutoruns AlwaysInstallElevated ``` Search for credentials and privilege escalation opportunities in the registry. ```bash theme={null} # Look for stored credentials SharpUp.exe audit CachedGPPPassword DomainGPPPassword RegistryAutoLogons UnattendedInstallFiles McAfeeSitelistFiles ``` Find plaintext credentials stored in various locations. ## Understanding Audit Mode Audit mode bypasses the default behavior where SharpUp exits early if you're already running with elevated privileges. ### When to Use Audit Mode **Without audit mode:** * SharpUp checks if you're in high integrity or a local administrator * If yes, it exits with a message suggesting UAC bypass or noting you're already elevated * Only runs checks if you're a non-privileged user **With audit mode:** * Runs all checks regardless of current privilege level * Useful for security auditing * Helpful for finding additional escalation paths even when already elevated * Note: Running in high integrity may yield false positives ## Troubleshooting **Problem:** Solution won't build **Solutions:** * Ensure Visual Studio 2015+ is installed * Verify .NET Framework 3.5 is installed * Clean solution (Build → Clean Solution) * Rebuild solution (Build → Rebuild Solution) **Problem:** Target system doesn't have .NET Framework 3.5 **Solutions:** * Install .NET Framework 3.5: ```powershell theme={null} # Windows 10/11 DISM /Online /Enable-Feature /FeatureName:NetFx3 /All # Or via PowerShell Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All ``` **Problem:** SharpUp reports no vulnerabilities **Solutions:** * This may be accurate - the system may be properly hardened * Try running with `audit` flag to force all checks * Verify you have the necessary permissions for the checks * Some checks require specific configurations to be present **Problem:** Access denied when running certain checks **Solutions:** * Some checks require local administrator privileges * Domain GPP checks require domain connectivity * File enumeration checks may fail in restricted environments * This is expected behavior for some checks in limited contexts ## Operational Security Consider these OPSEC factors when using SharpUp in operations: * Process execution of SharpUp.exe * Service enumeration via WMI queries * Registry key enumeration * File system enumeration * Token privilege enumeration * Network SMB access for domain GPP checks * Reading sensitive file locations * Rename binary to blend in with environment * Execute from memory via PowerShell * Use execute-assembly in C2 frameworks * Limit checks to specific targets using individual check names * Delete artifacts after use * Avoid running audit mode unnecessarily * Run targeted checks instead of all checks * Load as .NET assembly in memory * Use Donut/pe\_to\_shellcode for shellcode conversion * Execute via C2 framework execute-assembly * Inline execution from PowerShell * Obfuscate binary to avoid signatures ## Additional Resources Source code and latest releases Original PowerShell version of privilege escalation checks Download Visual Studio for compilation Understanding Windows privilege escalation techniques ## Next Steps Practical usage examples and workflows How to fix identified vulnerabilities Detailed documentation for each check