Querying Windows Service Configuration

The configuration of a Windows service — which binary it runs and under which account — is the first thing to read when hunting for service-based privilege escalation. Two interfaces expose the same underlying registry data: the sc.exe query and the registry itself. This is core to windows-services abuse.

sc.exe query config

sc.exe qc <service> (“query config”) prints the service’s control configuration:

sc.exe qc wuauserv

The two security-relevant fields:

• BINARY_PATH_NAME — the executable the service launches (the ImagePath). This is the field you check for an unquoted path or a binary in a writable directory.
• SERVICE_START_NAME — the account the service runs as (LocalSystem, NetworkService, a domain account). A privileged account here is what makes a weak binary path worth attacking.

sc.exe query <service> (without the c) reports runtime state (running/stopped/PID), a different question from configuration.

The registry backing store

Every service’s configuration lives under:

HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>

Key values:

• ImagePath — the executable / command line (same data as BINARY_PATH_NAME)
• ObjectName — the logon account (same as SERVICE_START_NAME)
• Start — start type (2 = automatic, 3 = manual, 4 = disabled)
• Security subkey — the service’s own DACL, which controls who may change the service — a distinct escalation surface from the binary’s file permissions (see exploit-service-all-access).

Querying directly:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath
reg query "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v ObjectName

Why this matters

Service recon is where most Windows privesc begins. Reading BINARY_PATH_NAME across all auto-start services surfaces unquoted paths and writable-binary targets; reading SERVICE_START_NAME tells you the privilege you’d inherit. Get-CimInstance Win32_Service | Select Name, PathName, StartName, StartMode is the scriptable equivalent that returns all of it at once.

Related

• windows-services — the service model these fields describe
• exploit-windows-services-unquoted-paths — attack keyed off the ImagePath field
• exploit-service-all-access — attack keyed off the service DACL in the Security subkey
• icacls — auditing whether BINARY_PATH_NAME’s target is writable

Sources

• Microsoft Learn — sc.exe query
• Microsoft Learn — Services (Services)