> ## Documentation Index > Fetch the complete documentation index at: https://docs.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # SharpUp Overview > C# port of PowerUp for Windows privilege escalation enumeration ## What is SharpUp? SharpUp is a **C# port of PowerUp functionality** for enumerating common Windows privilege escalation vectors. It performs automated checks to identify potential privilege escalation opportunities on Windows systems without requiring weaponization or exploitation. SharpUp is a port of [@mattifestation](https://twitter.com/mattifestation)'s [PowerUp](https://github.com/PowerShellMafia/PowerSploit/blob/dev/Privesc/PowerUp.ps1) from PowerSploit. Only enumeration checks have been ported - no exploitation functions are included. ## Key Features 15 different vulnerability checks for common Windows privesc vectors Enumeration only - no exploitation or modification of systems Run checks regardless of current privilege level Run all checks or specify individual checks to execute ## Available Checks SharpUp includes 15 privilege escalation enumeration checks: ### Service-Based Checks Identifies services where the current user can modify the service configuration Finds service binaries that the current user can modify Locates service registry keys that can be modified by the current user Identifies services with unquoted paths containing spaces (DLL hijacking opportunity) ### Registry-Based Checks Searches for plaintext credentials in registry AutoLogon configuration Finds modifiable registry autoruns (HKLM and HKCU Run keys) Checks if AlwaysInstallElevated policy is enabled (MSI privilege escalation) ### File-Based Checks Searches for unattended installation files that may contain credentials Locates McAfee SiteList.xml files containing encrypted passwords Searches local cache for Group Policy Preference passwords Searches domain SYSVOL for Group Policy Preference passwords ### Scheduled Task Checks Identifies scheduled tasks with modifiable binaries or scripts ### PATH & DLL Checks Finds modifiable directories in the system %PATH% variable Identifies running processes with missing DLLs (DLL hijacking opportunity) ### Token & Privileges Enumerates current user token privileges ## Basic Usage ```bash theme={null} # Run all checks (default behavior for non-admin users) SharpUp.exe # Run all checks in audit mode (regardless of privilege level) SharpUp.exe audit # Run specific check SharpUp.exe ModifiableServices # Run multiple specific checks SharpUp.exe ModifiableServices UnquotedServicePath # Audit mode with specific checks SharpUp.exe audit HijackablePaths RegistryAutoLogons ``` ## Audit Mode By default, SharpUp will not run checks if you're already a local administrator or in high integrity. Use `audit` mode to force all checks to run anyway. **Default Behavior:** * **High Integrity**: SharpUp detects this and skips checks (already privileged) * **Medium Integrity + Local Admin**: SharpUp suggests UAC bypass instead * **Standard User**: All checks run normally **Audit Mode Behavior:** * Runs all specified checks regardless of current privilege level * Useful for security auditing and compliance checking * Will produce false positives when run in high integrity ```bash theme={null} # Force all checks to run SharpUp.exe audit # Run specific checks in audit mode SharpUp.exe audit AlwaysInstallElevated RegistryAutoLogons ``` ## Typical Workflow Run all checks to identify potential privilege escalation vectors ```bash theme={null} SharpUp.exe ``` Analyze the output to identify the most promising vulnerabilities Re-run specific checks for verification or detailed information ```bash theme={null} SharpUp.exe ModifiableServices ``` Use the information to manually exploit identified vulnerabilities (SharpUp doesn't include weaponization) ## Example Output ``` === SharpUp: Running Privilege Escalation Checks === [*] Already in high integrity, no need to privesc! [*] Quitting now, re-run with "audit" argument to run checks anyway (audit mode). [*] Completed Privesc Checks in 0 seconds ``` **With Vulnerabilities Found:** ``` === ModifiableServices === Service 'VulnService' (C:\Services\service.exe) Start Permission: Everyone [AllAccess] === UnquotedServicePath === Service 'Unquoted Service' has unquoted path: C:\Program Files\My Service\service.exe ModifiablePath: C:\Program Files\My Service ``` ## Detection Considerations SharpUp performs enumeration activities that can be detected by EDR and security monitoring tools. ### Host-Based Detection * **Registry Enumeration**: Reading service configurations and Run keys * **File System Enumeration**: Searching for unattended install files and GPP passwords * **Service Queries**: Enumerating service ACLs and configurations * **Scheduled Task Queries**: Enumerating task configurations * **Token Queries**: Reading current process token privileges ### Behavioral Indicators * Process making numerous registry queries to service keys * Rapid enumeration of file system for specific file patterns * Querying service security descriptors * SYSVOL/netlogon share access (for Domain GPP checks) * Sequential execution of multiple privilege checks ### Defensive Measures * Monitor for rapid service configuration enumeration * Alert on SYSVOL access from non-DC systems * Track unusual registry key access patterns * Monitor for SharpUp.exe execution * Detect sequential privilege escalation check patterns * Remove unattended install files from systems * Disable AlwaysInstallElevated policy * Properly configure service ACLs * Quote all service paths * Remove cached GPP passwords * Implement least privilege for service accounts * Audit and restrict PATH directory permissions ## Prerequisites * Visual Studio 2015 Community Edition or later * .NET Framework 3.5 (default target) * Windows operating system * .NET Framework 3.5 or later * Standard user privileges (no elevation required) **Standard User:** * Can run all enumeration checks * Identifies privilege escalation opportunities **Administrator:** * SharpUp will detect and skip checks (use `audit` mode to force) * May produce false positives in high integrity ## Comparison with PowerUp | Feature | PowerUp | SharpUp | | ------------- | ------------------------------ | ------------------- | | Language | PowerShell | C# | | Checks | 15+ enumeration + exploitation | 15 enumeration only | | Weaponization | Included | Not included | | Execution | PowerShell.exe | Native .exe | | AMSI/CLM | Affected | Bypasses | | Footprint | Script loaded in memory | Binary execution | SharpUp focuses purely on enumeration. For exploitation, you'll need to manually leverage the identified vulnerabilities or use other tools. ## Use Cases Quickly identify privilege escalation vectors during assessments Enumerate local privilege escalation opportunities post-compromise Identify and remediate privilege escalation vulnerabilities Verify proper security configurations are in place ## Additional Resources Original PowerShell implementation Official SharpUp repository Comprehensive Windows privesc guide Other GhostPack security tools ## Next Steps Build SharpUp from source Detailed check documentation Practical usage scenarios Fix identified vulnerabilities ## License SharpUp is licensed under the BSD 3-Clause license. SharpUp is developed by [@harmj0y](https://twitter.com/harmj0y) and is a port of PowerUp by [@mattifestation](https://twitter.com/mattifestation).