Privilege Escalation · Term

What is weak service permissions?

If a low-privileged user can change a Windows service’s configuration or replace its executable, they can point it at their own code and have it run as SYSTEM. Here is what weak service permissions are and how they are abused.

Privilege Escalation · TermAll services
TL;DR

Weak service permissions are a Windows misconfiguration where a low-privileged user can modify a service they should not, by changing its binary path (SERVICE_CHANGE_CONFIG), by replacing the service executable (a writable binary), or by controlling its registry key. Because most services run as SYSTEM, the attacker repoints the service at their own command and restarts it to get SYSTEM. It is found by checking service ACLs and binary permissions with tools like accesschk.

By John Dill, Red Team Lead, SecureLayer7Updated

What weak service permissions are

A Windows service has both a configuration (including the executable path and the account it runs as) and an executable file on disk. Both are protected by permissions.

The misconfiguration is when a non-admin user has dangerous rights over a service:

  • SERVICE_CHANGE_CONFIG / SERVICE_ALL_ACCESS: the user can change the service’s binary path.
  • A writable service executable: the user can overwrite the .exe the service runs.
  • Write access to the service’s registry key: the user can alter how it starts.

Since services usually run as SYSTEM, any of these lets the user run code as SYSTEM.

The abuse and payload

The attacker enumerates service permissions, then repoints or replaces the service:

  • Check permissions: accesschk.exe -uwcqv <user> * (services the user can modify) or sc qc <svc>.
  • Reconfigure the binary path if allowed: sc config <svc> binPath= "cmd /c net localgroup administrators hacker /add" then sc stop <svc> & sc start <svc>.
  • Replace a writable service executable with a malicious one and restart the service.

The action runs as the service account, usually SYSTEM. Documented techniques shown for defenders.

How to defend

  • Restrict service permissions so non-admin users cannot change configuration (no SERVICE_CHANGE_CONFIG for standard users).
  • Protect service executables so only admins can write them.
  • Lock down service registry keys against non-admin writes.
  • Run services with least privilege rather than SYSTEM where possible.
  • Audit with accesschk-style tooling and monitor for service-config changes.

References

  1. [1]Microsoft: Service Security and Access Rights(Microsoft)
  2. [2]MITRE ATT&CK: Privilege Escalation (TA0004)(MITRE)
  3. [3]NIST SP 800-115 Technical Guide to Security Testing(NIST)
Related terms

Common questions

Privilege escalation, asked often

Want your systems tested for these paths?

Scope an engagement

Find the privilege-escalation paths before an attacker does.

We run internal and host penetration tests that walk the real route from a low-privileged foothold to root or SYSTEM, then hand your team a report with reproducible evidence and a fix for every step. Free re-test included.

See all services30-min scoping call, fixed-price proposal in 48 hours.