hunting-windows-service-privilege-escalation

Hunting Windows service privilege escalation: when a standard user decides what SYSTEM runs

A Windows service usually runs as a high-privileged account, often the local system account, and the service manager starts whatever binary the service configuration names. That is safe only if a low-privileged user cannot influence which binary runs or where it is found. When they can, the service becomes an escalation: the user changes the configured binary because the service object grants them that right, or replaces the binary because its file or directory is writable, or plants a file earlier on an unquoted path because an intervening directory is writable, or rewrites the service's registry configuration because its key is weakly permissioned. At the next start, the privileged account runs the attacker's code. The bug is not the service running as system; it is a standard user holding a write that reaches what system executes. You find these by listing services and asking, for each, whether a non-admin can change the binary, the path, or the config.

When to use

• A Windows host runs services as a privileged account and you can enumerate their config and permissions.
• Service binaries, their directories, or unquoted service paths may be writable by a standard user.
• Service objects or their registry keys may grant configuration rights to non-administrators.

Scope check

Test service escalation only on hosts you own or are authorized to assess, on non-production or a snapshot, using a benign marker payload that proves execution as the privileged account rather than taking real action with it. A confirmed path yields code execution as a system account, so keep every probe within the authorized scope. If you can't name the authorization, stop.

The loop

1. Establish the service's account and who can influence its target first. For each service, determine the account it runs as and whether a standard user holds any write that reaches what it executes: a service-object right to reconfigure it, write access to the binary or its directory, a writable directory earlier on an unquoted path, or write access to the service's registry key. This is the false-positive killer: a service whose binary, path, and configuration are writable only by administrators cannot be redirected by a standard user, however privileged the account it runs as. Name the specific write before claiming a path.