Weak Service Permissions Privilege Escalation

Windows services have their own access control lists separate from the binary they run. If your user has SERVICE_CHANGE_CONFIG or SERVICE_ALL_ACCESS on a service, you can change the binary path to anything: including a payload that runs as SYSTEM. This is distinct from service binary hijacking: you do not need to write to the binary's directory, only to modify the service configuration itself.

Prerequisites Check

Step 1: Find Services with Weak Permissions

Using accesschk:

Look for services showing any of these exploitable permissions:

• SERVICE_ALL_ACCESS (full control over the service)

• SERVICE_CHANGE_CONFIG (can modify the binary path)

• WRITE_DAC (can rewrite the service ACL to grant yourself more access)

Using PowerUp:

Manual check for a specific service:

Step 2: Confirm the Service Runs as SYSTEM

Look for SERVICE_START_NAME : LocalSystem. If it runs as a lower-privileged account, this technique escalates only to that account level.

Step 3: Modify the Binary Path

Change the service's binary path to your payload. The simplest payload adds an admin user:

Note the space after binPath=: this is required syntax for sc config.

Check if the user was added:

Now add to administrators:

Step 4: Get a Shell

For a reverse shell, first transfer the payload:

Change the binPath:

Start your listener:

Step 5: Restore the Service

After escalating, restore the original binary path to avoid leaving a broken service:

Understanding Service Permission Flags

You need at minimum SERVICE_CHANGE_CONFIG and SERVICE_START/SERVICE_STOP (or wait for a reboot with AUTO start type).

Using PowerUp for One-Step Exploitation

PowerUp's Invoke-ServiceAbuse automates the entire process: