Weak Service Permissions Privilege Escalation

Windows services have their own access control lists separate from the binary they run. If your user has SERVICE_CHANGE_CONFIG or SERVICE_ALL_ACCESS on a service, you can change the binary path to anything — including a payload that runs as SYSTEM. This is distinct from service binary hijacking — you do not need to write to the binary's directory, only to modify the service configuration itself.

Prerequisites Check

Step 1 — Find Services with Weak Permissions

Using accesschk:

Look for services showing SERVICE_ALL_ACCESS, SERVICE_CHANGE_CONFIG, or WRITE_DAC.

Using PowerUp:

Manual check for a specific service:

Step 2 — Confirm the Service Runs as SYSTEM

Look for SERVICE_START_NAME : LocalSystem. If it runs as a lower-privileged account, this technique escalates only to that account level.

Step 3 — Modify the Binary Path

Change the service's binary path to your payload. The simplest payload adds an admin user:

Note the space after binPath= — this is required syntax for sc config.

Check if the user was added:

Now add to administrators:

Step 4 — Get a Shell

For a reverse shell, first transfer the payload:

Change the binPath:

Start your listener:

Step 5 — Restore the Service

After escalating, restore the original binary path to avoid leaving a broken service:

Understanding Service Permission Flags

You need at minimum SERVICE_CHANGE_CONFIG and SERVICE_START/SERVICE_STOP (or wait for a reboot with AUTO start type).

Using PowerUp for One-Step Exploitation

PowerUp's Invoke-ServiceAbuse automates the entire process: